fix(ci): remove vulnerable ecdsa dependency from JWT stack

[boychina]

Summary

Fix the failing Backend CI dependency audit by replacing python-jose[cryptography] with PyJWT.

Root cause

python-jose pulls in ecdsa==0.19.2, which is reported by pip-audit for CVE-2024-23342 / GHSA-wj6h-64fc-37mp. The advisory has no fixed ecdsa release, so suppressing the audit would leave the vulnerable package in the runtime dependency graph.

Changes

• Replace python-jose[cryptography]>=3.5.0 with PyJWT>=2.13.0 in both dependency manifests.
• Keep the existing JWT API contract by aliasing PyJWTError as JWTError.
• Preserve issuer/audience/type/session validation and the configured signing algorithm.

Validation

Backend CI should exercise dependency policy/audit, auth tests, API tests and the existing release gates on this PR.