Feature Request: Token authentication via JWT and JWKS

I am using an authenticating proxy that has the ability to inject an HTTP header with a JWT.

I'd like to put Docspell behind this.

While oidc makes use of JWT tokens, I oidc is its own thing.

Essentially, Docspell would need to have a few configuration options:

* URL endpoint for the java web key set (jwks). Usually this would be something like https://mydomain.com/.well-known/jwks.json
* Configurable place to look for the JWT header. This could be an arbitrary `MyGreatJWT: ` or even `Authorization: Bearer: `.
* perhaps a configurable audience (aud).

The JWT would include information about the authenticated user. Usually it has at least a username, but different JWT providers can provide different things. If the user doesn't already exist, it would need to be created. The JWT can have information like groups and roles, so that could inform what collection should be used.

For reference, I am using [Teleport app access](https://github.com/gravitational/teleport/blob/branch/v12/docs/pages/application-access/jwt/introduction.mdx#validate-jwt). I work for Teleport, and I'm trying to put Teleport and Docspell into my homelab.

No files, tests, or entry points are identified in the issue. Start by reviewing Docspell's existing OIDC authentication path and configuration, then determine how JWKS validation, a configurable JWT header and audience, user creation, and group or role mapping should fit; done means these requested authentication options work end to end.

Written by the indexing model from the issue text.