security(keycloak): allowlist jwks_uri + warn when audience check is skipped

[DiTo97]

Surfaced by the #46 review gate (non-blocking; Keycloak auth is optional/off by default).

1. jwks_uri is taken verbatim from the OIDC discovery document (src/api/auth/keycloak_provider.py:259-261) and fetched — if the discovery endpoint is attacker-influenced this is an SSRF vector. Constrain jwks_uri to the issuer's host/scheme (allowlist) before fetching.
2. _verify_audience (keycloak_provider.py:388-390) returns early (no check) when OIDC_CLIENT_ID is unset. That's a documented dev shortcut, but should at least emit a startup warning so it isn't silently relied on in production.

(JWT iss validation itself was already fixed in #46 / f41f15b.)