security(jwt): safer audience-validation defaults and configuration guidance

[ZhuchkaTriplesix]

Context

JWT audience validation is disabled when jwt_audience is unset. This is intentional for flexibility but can become a security misconfiguration in multi-audience environments.

Goal

Provide safer defaults and stronger guidance to prevent accidental weak auth config.

Scope

• Evaluate opt-out vs opt-in audience validation policy.
• If behavior remains opt-in, add explicit warnings/docs and route-level guard options.

Acceptance criteria

• Clear, documented audience-validation policy in docs and API behavior.
• Tests cover configured and unconfigured audience cases.
• Security guidance includes migration notes if default behavior changes.

Out of scope

• Full OIDC/JWKS policy engine.