feat(ap1): enforce resource audience

scripts/verify-pattern1.sh

@@ -12,10 +12,12 @@ set +a
 
 docker compose down --volumes --remove-orphans
 docker compose up --build -d --wait
+docker compose --profile diagnostics up -d --wait app-wrong-audience
 
 npm --prefix e2e ci
 E2E_USERNAME=regular-user \
 E2E_PASSWORD="$REGULAR_USER_PASSWORD" \
+WRONG_AUDIENCE_URL=http://localhost:18081/api/me \
   npm --prefix e2e run test:pattern1
 
 echo "AP1 verified end to end"