test(ap1): reproduce issuer mismatch

e2e/pattern1.mjs

@@ -74,6 +74,17 @@ try {
     );
   }
 
+  if (process.env.WRONG_ISSUER_URL) {
+    const response = await fetch(process.env.WRONG_ISSUER_URL, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    assert.equal(
+      response.status,
+      401,
+      "the same signed token must fail when the Resource Server expects another issuer",
+    );
+  }
+
   await page.reload();
   await page.locator('[data-authenticated="false"]').waitFor();
   assert.equal(
@@ -83,7 +94,7 @@ try {
   );
 
   console.log(
-    "pattern1 browser verified: code+PKCE S256, audience positive 200/negative 401, Web Storage token 0, reload clears token",
+    "pattern1 browser verified: code+PKCE S256, audience/issuer negatives 401, Web Storage token 0, reload clears token",
   );
 } finally {
   await browser.close();