security: replace python-jose with PyJWT for JWT handling

[PeakPy]

Description

Replaces python-jose with PyJWT to address known security vulnerabilities (CVE-related to alg=none bypass and denial-of-service).

Partially addresses #248 (JWT security concern)

Changes

• Removed python-jose>=3.3.0 dependency
• Added PyJWT>=2.8.0 dependency
• Updated JWT encoding/decoding in security.py to use PyJWT API
• Updated exception handling in logout.py to catch jwt.PyJWTError
• Converted exp claim to Unix timestamp for PyJWT compliance
• Updated uv.lock with new dependency tree

Tests

All existing tests pass (11/11):

• Authentication flow
• Token creation and verification
• User CRUD operations

Checklist

• I have read the CONTRIBUTING document
• My code follows the code style of this project (ruff, mypy pass)
• I have added necessary documentation (if appropriate)
• I have added tests that cover my changes (existing tests validate behavior)
• All new and existing tests passed

Additional Notes

• Token format and behavior remain unchanged for backward compatibility
• PyJWT is already a transitive dependency, so lock file impact is minimal
• This PR focuses only on the JWT library migration (other items in Dependency & Security Review: JWT, Database, and Background Worker Concerns #248 can be separate PRs)