security: harden introspection verifier — fix client_id fallback and wire config.audience

[coderabbitai]

Summary

Two hardening items for buildIntrospectionVerifier in src/mcp_server/auth/oauth.ts, deferred from PR #63.

1. client_id fallback

When the introspection response omits client_id, the verifier currently substitutes the resource server's own clientId. This means SCS_MCP_OAUTH_ALLOWED_CLIENT_IDS is evaluated against the wrong principal. The fix should reject the token (fail closed) when client_id is absent from the introspection response.

2. config.audience override not wired

buildIntrospectionVerifier does not receive config.audience, unlike the JWKS path. Audience validation therefore cannot use an explicit override. The fix should accept config.audience as a parameter and use it during audience validation, mirroring the JWKS verifier behaviour.

Out of scope

Missing aud in introspection responses is intentionally not fail-closed: providers such as Keycloak routinely omit aud from introspection results, so skipping audience validation when aud is absent is acceptable behaviour.

---

Reported in: #63 (comment: #63 (comment))
Requester: @Coolomina