security: remove vulnerable JWT transitive dependency

[boychina]

Summary

Restore Backend CI by removing the vulnerable ecdsa transitive dependency instead of weakening the dependency-audit gate.

Fix

• Replace python-jose[cryptography] with PyJWT in both direct dependency manifests.
• Preserve QTable's existing HS256 access/refresh token behavior and exported JWTError contract using PyJWT's InvalidTokenError.

Failure addressed

Backend CI failed at pip-audit --strict because python-jose pulls ecdsa==0.19.2, which is affected by the Minerva timing side-channel advisory and currently has no upstream fixed release. QTable's configured JWT algorithm is HS256, so the ECDSA dependency is unnecessary.

This PR keeps the security gate strict and removes the vulnerable dependency from the runtime graph rather than adding an audit exception.