[AZ-494] [AZ-492] Cycle 3 Step 16: full test suite green; close batches

Final cumulative review for batches 04-05 (PASS_WITH_WARNINGS, 4 Low
findings, all non-blocking). Combined with the prior 01-03 cumulative,
this closes the per-cycle batch coverage with two PASS_WITH_WARNINGS
verdicts.

scripts/run-tests.sh --full green: format check + 13 cycle-3 unit
tests (including the 4 new AZ-494 fail-fast cases for missing /
empty iss / aud) + the full integration suite (including the 2 new
WrongIssuer / WrongAudience 401 assertions).

Fixed a stale "leave blank to fall back" comment in .env.example
that contradicted the "REQUIRED" line right above it; the integration
runner reads env vars directly with no appsettings fallback so blank
values now fail-fast.

Advanced _docs/_autodev_state.md to mark Step 10 (Implement) status:
completed.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -22,11 +22,14 @@ JWT_SECRET=
 #
 # Production values MUST be confirmed by the admin team before deploy
 # (the admin API stamps the `iss` claim; satellite-provider validates
-# the `aud` claim). For local dev these can use the DEV-ONLY values
-# baked into appsettings.Development.json — leave blank to fall back.
+# the `aud` claim).
 #
-# Example values (NEVER use these in prod):
-#   JWT_ISSUER=DEV-ONLY-iss-admin-azaion-local
-#   JWT_AUDIENCE=DEV-ONLY-aud-satellite-provider
-JWT_ISSUER=
-JWT_AUDIENCE=
+# For local dev / CI: use the DEV-ONLY values below. The integration
+# test runner and scripts/run-tests.sh read these directly from the
+# environment (no appsettings fallback on the test side), so leaving
+# them blank will cause run-tests.sh to refuse to start.
+#
+# NEVER ship these DEV-ONLY values to prod — they exist only to make
+# local-dev mints validate against appsettings.Development.json:
+JWT_ISSUER=DEV-ONLY-iss-admin-azaion-local
+JWT_AUDIENCE=DEV-ONLY-aud-satellite-provider