perf(artifact-cas): parse the EC public key once instead of per request
Merged
MA
3mo ago+101+101+012345678901234567890123456789-31-31-01234567890123456789
Summary
The JWT verification keyfunc in the artifact CAS re-parsed the public key PEM on every authenticated request, across the gRPC unary, gRPC stream, and HTTP download paths.
This parses the EC public key once at server construction and shares a single keyfunc closure across all interceptors. The path resolution and key-loading logic, previously duplicated between the gRPC and HTTP servers, is consolidated into a single helper.
A malformed or unreadable key now fails at server startup instead of surfacing as a per-request authentication error. The change is otherwise behavior-preserving: the key was already loaded once at startup, so no runtime key-handling behavior changes.