fix: OIDC audience validation - use string not list

python-jose jwt.decode() requires audience as string or None, not list.
Now extract and validate audience from unverified claims first,
then use token's actual audience for JWT decode.

Fixes "audience must be a string or None" error.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/domains/auth/oidc.py

@@ -185,6 +185,7 @@ async def get_current_user(
 
         kid = unverified_header.get("kid")
         token_issuer = unverified_claims.get("iss", "")
+        token_audience = unverified_claims.get("aud", "")
 
         if not kid:
             raise HTTPException(status_code=401, detail="Invalid token format")
@@ -195,6 +196,11 @@ async def get_current_user(
             logger.warning(f"Invalid token issuer: {token_issuer} (allowed: {oidc_config.issuers})")
             raise HTTPException(status_code=401, detail="Invalid token issuer")
 
+        # Validate audience is in allowed list
+        if token_audience not in oidc_config.audiences:
+            logger.warning(f"Invalid token audience: {token_audience} (allowed: {oidc_config.audiences})")
+            raise HTTPException(status_code=401, detail="Invalid token audience")
+
         # Get JWKS for this specific issuer
         jwks = get_jwks_for_issuer(token_issuer)
         rsa_key = None
@@ -208,13 +214,13 @@ async def get_current_user(
             logger.warning(f"No matching key found for kid: {kid}")
             raise HTTPException(status_code=401, detail="Invalid token key")
 
-        # Verify and decode token using the token's actual issuer
+        # Verify and decode token using the token's actual issuer and audience
         payload = jwt.decode(
             token,
             rsa_key,
             algorithms=["RS256"],
-            audience=oidc_config.audiences,
-            issuer=token_issuer,  # Use the token's issuer for validation
+            audience=token_audience,  # Use the token's audience (already validated)
+            issuer=token_issuer,  # Use the token's issuer (already validated)
         )
 
         user_email = payload.get("email", "unknown")