JWT bearer validation skips audience check on the production Keycloak path

[PianoNic]

`Extensions/AuthenticationExtensions.cs:43` sets `ValidateAudience = false` on the production JWT bearer options. Any token issued by the trusted issuer/realm is accepted, including tokens minted for unrelated Keycloak clients in the same realm — not just `schuly-app`.

Fix: set `ValidAudience`/`ValidAudiences` explicitly to `schuly-app` (plus any other legitimate client IDs).

Found during the Aug 2026 security sweep.