fix(cmms): verify Hub SSO assertions with UTF-8 secret bytes

[Mikecranesync]

Summary

• verify Hub SSO JWT assertions with UTF-8 secret bytes so Atlas matches the Hub jose signer
• add regression coverage for base64-looking shared secrets, which previously failed with JJWT string-key parsing

Verification

• git diff --check
• Local Maven unavailable on CHARLIE; CI must run the focused Java test and build.

Cascade context

This unblocks the live Hub -> Atlas CMMS SSO exchange after PR #190 and MIRA PR #2319 were deployed.