pub fn sign_app_jwt(app_id: u64, private_key_pem: &str) -> Result<String>
Sign a JWT for the given app id + PEM private key. Lives 9 minutes (GitHub’s max is 10; subtract 1 for clock skew).