Store the CDP auth key as a crypto.Signer interface so ECDSA and Ed25519 keys
share one signing path, and detect raw base64 Ed25519 keys inline instead of a
separate helper.
- Proper key type detection: Ed25519 (base64, 64 bytes) vs EC (PEM)
- Fixed PKCS8 fallback - removed incorrect PKCS8->EdDSA path for EC keys
- Added 'iat' claim to match official SDK
- Added base64 import for Ed25519 key decoding
- Return proper errors instead of ignoring them in GetAuthHeaders
- Added unit tests for EC/Ed25519 keys, token generation, and auth headers
- config: MATRIX_WEBHOOK_URL / MATRIX_SERVER_ID via os.Getenv (optional),
keep hostname fallback for MatrixServerID, avoid Fatal when webhook
not configured (test-endpoints omits it, webhook.go nil-safe)
- auth: NewCDPAuth converts literal \n to real newlines before
pem.Decode, so Forgejo single-line secret
-----BEGIN EC PRIVATE KEY-----\n... works while malformed
still returns error and CI fails via log.Fatal (as required)