fix: catch PyJWKSetError in JWT verification fallback

PyJWKSetError is not a subclass of PyJWKClientError — they are siblings
under PyJWTError. The empty JWKS key set error was not being caught.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/src/app/core/auth.py

@@ -3,7 +3,7 @@ from uuid import UUID
 
 import jwt
 from fastapi import Depends, HTTPException, Request, status
-from jwt import PyJWKClient, PyJWKClientError
+from jwt import PyJWKClient, PyJWKClientError, PyJWKSetError
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -75,6 +75,8 @@ def _verify_jwt(token: str) -> dict | None:
             pass
         except PyJWKClientError:
             pass
+        except PyJWKSetError:
+            pass
     return _verify_jwt_hs256(token)