fix: accept multiple OIDC audiences for cross-client auth

- Changed oidc_audience (string) to oidc_audiences (list)
- Now accepts tokens with audience: core-api, tatlock-ui, tatlock
- Fixes environment endpoint returning "default" user when using
  tatlock-ui token (audience mismatch was causing JWT claims error)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/auth/oidc.py

@@ -23,16 +23,16 @@ class OIDCConfig:
         # These will be set from environment variables in config.py
         self.enabled = False
         self.issuer = ""
-        self.audience = ""
+        self.audiences: list[str] = []
         self.jwks_uri = ""
 
-    def configure(self, enabled: bool, issuer: str, audience: str):
+    def configure(self, enabled: bool, issuer: str, audiences: list[str]):
         """Configure OIDC settings"""
         self.enabled = enabled
         self.issuer = issuer
-        self.audience = audience
+        self.audiences = audiences
         self.jwks_uri = f"{issuer.rstrip('/')}/jwks/"
-        logger.info(f"OIDC configured: enabled={enabled}, issuer={issuer}")
+        logger.info(f"OIDC configured: enabled={enabled}, issuer={issuer}, audiences={audiences}")
 
 
 # Global OIDC config instance
@@ -129,12 +129,12 @@ async def get_current_user(
             logger.warning(f"No matching key found for kid: {kid}")
             raise HTTPException(status_code=401, detail="Invalid token key")
 
-        # Verify and decode token
+        # Verify and decode token (accepts any of the configured audiences)
         payload = jwt.decode(
             token,
             rsa_key,
             algorithms=["RS256"],
-            audience=oidc_config.audience,
+            audience=oidc_config.audiences,
             issuer=oidc_config.issuer,
         )