perf(keys): borrow key material instead of cloning on every encode/decode #121

Problem

EncodingKeyMaterial::encoding_key() and DecodingKeyMaterial::decoding_key() return self.key.clone() (rust/src/keys.rs:166, rust/src/keys.rs:189), and jsonwebtoken's verifier/signer factory clones the key again into a Box. For RSA that is two ~1.2 KB DER heap copies per call; for HMAC it also leaves non-zeroized copies of the secret behind (only the intermediate buffer is Zeroizing).

Proposal

Mark EncodingKey / DecodingKey as #[pyclass(frozen)], borrow via Bound::get() (no PyRef borrow-flag check), and pass &Jwt*Key into py.detach instead of an owned clone. Combines naturally with the cached-parsed-key work (#120).

Acceptance criteria

• No key clone on the encode / decode / decode_verified_complete hot paths when a prebuilt key object is passed
• Key classes are frozen
• No behavior change; tests green

Files

• rust/src/keys.rs, rust/src/api.rs

Branch

issue/<N>-borrow-keys from dev