feat: add NATS nkey (ed25519) JWT support

[johnweldon]

Summary

Add support for encoding and decoding JWTs using NATS nkeys (ed25519-based
keys with base32 encoding). This enables full compatibility with NATS
authentication tokens and other nkey-signed JWTs.

Features:

• Encode JWTs using nkey seeds with EdDSA algorithm
• Decode/verify JWTs using nkey seeds or public keys
• Automatic normalization of NATS JWTs ("ed25519-nkey" → "EdDSA")
• Support for both string and file-based nkey inputs

Implementation:

• Detect nkey format by prefix (S/P for seeds, A/U/O/N/C/M/V/X for public keys)
• Convert nkeys to raw Ed25519 bytes via nkeys crate
• Transform to PKCS#8/SPKI PEM format for jsonwebtoken compatibility
• Normalize NATS JWT headers to enable parsing by jsonwebtoken

Dependencies:

• nkeys 0.4: NATS nkey format handling
• ed25519-dalek 2.2 (pkcs8 feature): Ed25519 cryptographic operations
• base64 0.21: JWT header manipulation for normalization

Testing:

• 4 test nkey files (user/account seeds and public keys)
• 7 new integration tests covering encoding, decoding, and error cases
• All 62 tests passing

This allows jwt-cli to work seamlessly with NATS ecosystem JWTs and
provides a convenient way to handle ed25519-nkey authentication tokens.

Preflight checklist

• Code formatted rustfmt ($ cargo fmt)
• Code linter check with clippy ($ cargo clippy)
• Relevant tests added
• Any new documentation added