fix: bind aud claim on signed user tokens

[Bccorb]

Problem

The Seamless adapter now verifies signed auth responses with aud === audience (the unreleased verify-audience-binding change in seamless-auth-server), but no signer here ever set an aud claim. jose rejects a token that lacks a claim it was told to check, so once that adapter change ships, every handler calling verifySignedAuthResponse fails: login, finishLogin, finishRegister, OAuth, OTP, magic-link, and organization-switch. This is a release blocker on both sides.

Core's tests mock jose, which is why CI did not catch it.

Fix

signAccessToken, signRefreshToken, and signEphemeralToken now call .setAudience(ISSUER) in addition to .setIssuer(ISSUER). The deployment contract requires the adopter's audience to equal its authServerUrl, which is byte-identical to this server's ISSUER, so aud === ISSUER is exactly what the adapter checks. The claim is additive and ignored by verifiers that do not check it (the API's own sessionService verifies issuer only).

The token unit test now captures and asserts the bound audience, closing the jose-mock blind spot.

Verification

• Full suite: 951 passing, 1 skipped. Typecheck and format clean.
• End to end with real jose against the built core and a live JWKS endpoint: a token with aud bound is accepted (sub returned); a token without it is rejected. This reproduces the blocker and confirms the fix.

Coordination

Must release together with the verify-audience-binding change in seamless-auth-server. See the fixed M2M service-token contract (iss=seamless-portal-api, aud=seamless-auth), which is separate from these user-token claims and unchanged here.