Accepts two multipart parts:
• metadata – JSON (SignatureUtilityApi)
containing the caller's detached-JWS object (signatureBase64)
and the corresponding publicKey.
• file – the raw payload that was signed.

The controller ignores any kid inside the JWS header
and uses the public key supplied by the caller for streaming
verification. On success the endpoint returns a
VerifySignatureResponse with isValid=true.