Backport of #1032 to v2.6. If the gateway started before IAM was ready
and exhausted its startup retries, _signing_public_pem stayed None and
all JWT authentication permanently 401'd with no recovery path short of
a restart. Now _verify_jwt retries the fetch once on demand, so the
gateway self-heals as soon as IAM becomes available.