Centralize user JWT signing-key trust validation in AccountManager

[choufraise]

Follow-up from #306 (comment).

The User signing flow should not infer whether an Account signing key is valid, trusted, or ready by reading Account spec/status outside the AccountManager path. That creates duplicated business logic and can trust an Account before its spec has been validated and accepted.

Move the signing-key trust/readiness decision behind AccountManager, so User JWT signing uses the same mechanism as Account reconciliation.

Acceptance criteria

• User JWT signing delegates Account readiness and signing-key trust validation to AccountManager.
• User/controller code does not trust signing keys from Account.spec directly.
• Not-ready or unvalidated Accounts cannot be used to sign User JWTs.
• Add regression coverage, preferably e2e, for ready vs not-ready Account behavior.