chore: replace key-encoder with native JWK import and @noble/curves

[dreyfus92]

What & why

drops the key-encoder dependency from pds, bsky, aws and xrpc-server, which also removes its whole transitive tree (elliptic, asn1.js, bn.js).

key-encoder had exactly one job here: converting raw secp256k1 key bytes into PEM so node:crypto could import them. but node can import keys directly from a JWK, which is just a JSON object with the key coordinates base64url-encoded, so the auth verifiers in pds/bsky now build KeyObjects that way, slicing the x/y coordinates out of the uncompressed point via @noble/curves (already in the tree via @atproto/crypto).

the aws kms case gets its public key SPKI DER-encoded, and for secp256k1 the raw 65-byte point is always the trailing bytes of that structure, so we slice those and validate with noble's ProjectivePoint.fromHex instead of parsing the DER. tests build private keys as JWKs too, deriving the public coordinates explicitly with secp256k1.getPublicKey() since a private EC JWK requires them alongside d (the old PEM path did the same derivation, just hidden inside openssl).

Note

behavior is unchanged for all valid inputs: same KeyObjects, same signatures, compressed and uncompressed keys both still accepted. the one difference is that garbage keys now fail at parse time with an on-curve check, which key-encoder never did.

related: #5341

Checklist

• pnpm build --force && pnpm verify passes
• Tests pass, and new behavior is covered by tests
• A changeset is included for every package this touches
• Written with the help of an LLM or coding agent? Say so here, and name the tooling.