fix(auth): add JWT audience claim and disable issuer validation

- Added Keycloak audience protocol mapper to workclub-app client
  - Maps 'workclub-api' to aud claim in access tokens
- Disabled issuer validation in API for local dev
  - External clients use localhost:8080, internal use keycloak:8080
  - Prevents validation mismatch in Docker network environment

This resolves 401 Unauthorized errors on all authenticated endpoints.

Ref: .sisyphus/evidence/final-f3-manual-qa.md lines 418-444

docker-compose.yml

@@ -63,6 +63,7 @@ services:
       ConnectionStrings__DefaultConnection: "Host=postgres;Port=5432;Database=workclub;Username=workclub;Password=dev_password_change_in_production"
       Keycloak__Authority: "http://keycloak:8080/realms/workclub"
       Keycloak__Audience: "workclub-api"
+      Keycloak__TokenValidationParameters__ValidateIssuer: "false"
     ports:
       - "5001:8080"
     volumes: