fix: fall back to manifest XML for signing_key default

Hidden field defaults aren't stored in database params until the plugin
is re-saved. All 3 heartbeat paths now read the signing_key default
from the monitor plugin's manifest XML as a fallback.

source/script.php

@@ -833,9 +833,28 @@ class Pkg_MokowaasInstallerScript
 
 			$headers = ['Content-Type: application/json'];
 
-			// RSA sign the request
+			// RSA sign the request — fall back to manifest XML default
 			$signingKeyB64 = $monitorParams->signing_key ?? '';
 
+			if (empty($signingKeyB64))
+			{
+				$manifestFile = JPATH_PLUGINS . '/system/mokowaas_monitor/mokowaas_monitor.xml';
+
+				if (is_file($manifestFile))
+				{
+					$xml = simplexml_load_file($manifestFile);
+
+					if ($xml)
+					{
+						foreach ($xml->xpath('//field[@name="signing_key"]') as $field)
+						{
+							$signingKeyB64 = (string) $field['default'];
+							break;
+						}
+					}
+				}
+			}
+
 			if (!empty($signingKeyB64))
 			{
 				$privateKeyPem = base64_decode($signingKeyB64);