fix: accept multiple OIDC audiences for cross-client auth

- Changed oidc_audience (string) to oidc_audiences (list)
- Now accepts tokens with audience: core-api, tatlock-ui, tatlock
- Fixes environment endpoint returning "default" user when using
  tatlock-ui token (audience mismatch was causing JWT claims error)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/shared/security.py

@@ -24,13 +24,13 @@ def initialize_oidc(settings: Settings) -> None:
     auth_oidc_config.configure(
         enabled=settings.oidc_enabled,
         issuer=settings.oidc_issuer,
-        audience=settings.oidc_audience
+        audiences=settings.oidc_audiences
     )
 
     domains_oidc_config.configure(
         enabled=settings.oidc_enabled,
         issuer=settings.oidc_issuer,
-        audience=settings.oidc_audience
+        audiences=settings.oidc_audiences
     )
 
     if settings.oidc_enabled: