* feat(auth): allow JWT IP changes by configuration
* fix(auth): make JWT IP change setting concurrency-safe
* test(auth): move JWT IP change setting tests out of MCP test file
NZ_JWTSECRETKEY takes priority over config.yaml, env-injected keys are
not persisted and skip the version-driven rotation. When the secret is
auto-generated as a last-resort fallback, write it via a single-field
YAML patch so we never round-trip the in-memory key back to disk.
The JWTSecretKey field is marked json:"-" yaml:"-" so Save() can no
longer leak it. Update ReadEnvFile test to lock in env-over-yaml
precedence.
Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>