fix: explicitly pass RS256 algorithm to jose.jwk.construct to handle JWKS keys without alg field

backend/auth.py

@@ -52,7 +52,7 @@ def _decode_token(token: str, jwks):
         if not key_dict:
             raise HTTPException(status_code=401, detail="Invalid token: signing key not found")
 
-        key = construct(key_dict)
+        key = construct(key_dict, algorithm="RS256")
         decode_kwargs = {"algorithms": ["RS256"]}
         if AUTH_CLIENT_ID:
             decode_kwargs["audience"] = AUTH_CLIENT_ID