Resolve the JWKS publishing path for a deployment. This is the SINGLE
source of truth for both (a) where the JWKS route registers itself and
(b) the jwks_uri OIDC discovery advertises. The core jwksModule and
the oauth discovery route MUST both resolve the path through this
function so the two endpoints can never drift — neither the config key
(oauth.jwt.jwksPath) nor the default is duplicated at a call site.
The configured value is validated by the config schema (oauth.jwt.jwksPath
via isValidJwksPath); this resolver re-applies the same check so a
caller that bypasses the schema (hand-built config) still falls back to the
default rather than publishing keys at — and advertising — a malformed path.
Resolve the JWKS publishing path for a deployment. This is the SINGLE source of truth for both (a) where the JWKS route registers itself and (b) the
jwks_uriOIDC discovery advertises. The corejwksModuleand the oauth discovery route MUST both resolve the path through this function so the two endpoints can never drift — neither the config key (oauth.jwt.jwksPath) nor the default is duplicated at a call site.The configured value is validated by the config schema (
oauth.jwt.jwksPathvia isValidJwksPath); this resolver re-applies the same check so a caller that bypasses the schema (hand-built config) still falls back to the default rather than publishing keys at — and advertising — a malformed path.