When set, fetches JWKs from this URL directly instead of discovering from the OIDC well-known endpoint. Needed when the public issuer URL (e.g., https://domain.com/oidc) isn't reachable from inside containers but the internal URL (http://logto:3001/oidc/jwks) is. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>