Registers an RSA public key (2048-bit or larger, PEM) used to sign payment-decision requests. Keys are immutable per tenant; rotate by registering a new key_id.