fix: accept multiple OIDC audiences for cross-client auth

- Changed oidc_audience (string) to oidc_audiences (list)
- Now accepts tokens with audience: core-api, tatlock-ui, tatlock
- Fixes environment endpoint returning "default" user when using
  tatlock-ui token (audience mismatch was causing JWT claims error)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.10.5] - 2026-01-07
+
+### Fixed
+
+- **OIDC audience mismatch** - Accept tokens from multiple clients
+  - Changed `oidc_audience` (string) to `oidc_audiences` (list)
+  - Now accepts tokens with audience: `core-api`, `tatlock-ui`, or `tatlock`
+  - Fixes environment endpoint returning "default" user instead of authenticated username
+
 ## [1.10.4] - 2026-01-07
 
 ### Removed