[#6817, #6939] update release notes

[andreyorst]

adds info on new behavior when keypair is not configured properly

[Aitem]

QA Review: Documentation PR #127

Tested against implementation PR #6942 (branch 6817-fail-fast, commit 96eba9c8c6).

Test Results: 14/15 PASS

Full QA report posted to #6939.

Issues Found in Documentation

1. EC key support not mentioned. The implementation supports both RSA (RS256) and EC (ES256) keys. Documentation only shows RSA examples and headers. The all-settings.md warning specifically says -----BEGIN RSA PRIVATE KEY----- — this is misleading since EC keys (-----BEGIN EC PRIVATE KEY-----) are also valid.

2. "Wrong key type" in common mistakes table is incorrect. configure-aidbox-and-multibox.md lists "Using an EC key instead of RSA, or vice versa" as a common mistake. However, EC keys are fully supported by the validation. This entry should be removed or changed to "Unsupported key type (e.g., DSA)".

3. JWKS endpoint bug with EC keys. While startup validation accepts EC keys, /.well-known/jwks.json returns HTTP 500 when EC keys are configured (No matching field found: getPublicExponent for class BCECPublicKey). This is a code bug, not a documentation issue, but should either be fixed in PR #6942 or documented as a limitation.

What's Correct

• ✅ Danger hint about startup validation behavior
• ✅ "Both keys must be set together" requirement
• ✅ PEM format requirement with BEGIN/END headers
• ✅ Common mistakes: bare base64, truncated key, mismatched pair
• ✅ Deprecated env var names mentioned
• ✅ FAQ troubleshooting section is clear and helpful
• ✅ Release notes entry is accurate

cc @andreyorst @Aitem

[spicyfalafel]

LGTM

[Aitem]

LGTM