Seal TOURNAMENT_BOT_TOKEN as ncs-tournament-bot-secret and inject it
plus TOURNAMENT_SERVER_URL into the official-bots rollout so the bot
parks itself on http://141.37.123.132:8086 at startup.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The merged rollout set JWT_PUBLIC_KEY_PATH, but the running image's
config never references it, so mp.jwt.verify.publickey.location stayed
null and every token failed with "Verification key is unresolvable".
Replace it with the MicroProfile properties the runtime reads directly
(MP_JWT_VERIFY_PUBLICKEY_LOCATION, MP_JWT_VERIFY_ISSUER), pointing at the
already-mounted ncs-jwt-keys public key. No image rebuild needed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>