Fix rich consent signing with Android Keystore keys

[lucas-heidihealth]

Summary

• Fix rich-consent DPoP signing for Android Keystore-backed RSA keys.
• Use JCA Signature with the existing PrivateKey abstraction instead of casting to RSAPrivateKey.

Root cause

RichConsentsAPIClient casts the enrollment PrivateKey to RSAPrivateKey before signing. Android Keystore provides AndroidKeyStoreRSAPrivateKey, which can sign through Signature but does not implement java.security.interfaces.RSAPrivateKey. This causes Guardian.fetchConsent to crash before the request is sent.

This is the same failure reported in #149.

Verification

ANDROID_HOME=/Users/lucas/Library/Android/sdk ./gradlew :guardian:testDebugUnitTest
BUILD SUCCESSFUL

The existing rich-consent client tests pass, and the signing implementation now follows the same SHA256withRSA/PrivateKey approach already used by the SDK's allow/reject request path.