fix: split JWK fetch (Docker-internal) from issuer validation (localhost)

crypto.subtle requires a secure context, so the browser must access
everything via localhost. The custom JwtDecoder already supports this
split: jwk-set-uri uses Docker-internal logto:3001 for network fetch,
while issuer-uri uses localhost:3001 for string-only claim validation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -106,7 +106,7 @@ services:
       LOGTO_ENDPOINT: ${LOGTO_ENDPOINT:-http://logto:3001}
       LOGTO_PUBLIC_ENDPOINT: http://${PUBLIC_HOST:-localhost}:3001
       LOGTO_ISSUER_URI: http://${PUBLIC_HOST:-localhost}:3001/oidc
-      LOGTO_JWK_SET_URI: http://${PUBLIC_HOST:-localhost}:3001/oidc/jwks
+      LOGTO_JWK_SET_URI: ${LOGTO_ENDPOINT:-http://logto:3001}/oidc/jwks
       LOGTO_M2M_CLIENT_ID: ${LOGTO_M2M_CLIENT_ID:-}
       LOGTO_M2M_CLIENT_SECRET: ${LOGTO_M2M_CLIENT_SECRET:-}
       CAMELEER3_SERVER_ENDPOINT: http://cameleer3-server:8081