No JWKS endpoint

To my understanding, when implementing OIDC, you need a JWKS endpoint. (A discovery endpoint would also be pretty helpful). Perhaps I'm missing something, but this example doesn't seem to provide a way for the client to validate the bundled OIDC profile because there's no jwks endpoint.

Start by examining the example's OIDC server routes and how the bundled OIDC profile is exposed. Identify where a JWKS endpoint would fit, then check the OIDC requirements for discovery and client validation; done means clients can retrieve the signing keys and discover the server metadata.

Written by the indexing model from the issue text.