fix(auth): verify aud on access tokens, require typ, and require exp on service tokens #430

Why

• verifyJwtWithKid (src/services/sessionService.ts) checks signature, issuer and algorithm, and typ only when the caller passes an expected type. It does not check aud, although the comment near line 274 and docs/security-posture.md say audience is enforced.
• Internal service JWTs are verified with jsonwebtoken, which accepts a token with no exp (src/middleware/authenticateServiceToken.ts).
• v0.21 adds an OpenID Provider that signs its own tokens. Before that ships, a token minted for one purpose must not be accepted for another.

What

• Pass the expected audience to jwtVerify for access and ephemeral tokens
• Make the expected typ mandatory at every call site
• Reject service JWTs without exp, and cap their lifetime
• Correct the comment and the posture doc to match

Done when

Tokens with the wrong audience, the wrong type, or no expiry are rejected, with a test for each.