[AZ-494] Enable JWT iss/aud validation with fail-fast startup

Option B per user decision: production ships with empty Jwt.Issuer /
Jwt.Audience in appsettings.json so the API process refuses to start
unless JWT_ISSUER + JWT_AUDIENCE env vars are supplied. Development
ships with grep-friendly DEV-ONLY- placeholders so local + docker
flows keep working unchanged.

AuthenticationServiceCollectionExtensions flips ValidateIssuer +
ValidateAudience to true and wires ValidIssuer / ValidAudience via a
new ResolveRequiredOrThrow helper that all three required values
(secret, iss, aud) now share. JwtTokenFactory.Create + CreateExpired
gain optional iss / aud parameters (default null) so existing call
sites compile unchanged. JwtTestHelpers adds MintAuthenticated /
MintExpired wrappers that resolve iss + aud from env, plus
ResolveIssuerOrThrow / ResolveAudienceOrThrow. PerfBootstrap.MintToken
+ Program.cs JWT bootstrap migrated to the new surface so the perf
harness and the integration runner both validate against the same
contract.

Adds 4 fail-fast unit tests (missing/empty issuer + audience), 2
negative integration scenarios (WrongIssuer_Returns401,
WrongAudience_Returns401), and re-tags every existing integration
mint site via MintAuthenticated.

Compose, .env.example, run-tests.sh, run-performance-tests.sh all
load + export JWT_ISSUER + JWT_AUDIENCE alongside JWT_SECRET.

Resolves F-AUTH-2 (security_report.md + owasp_review.md). AC-7
(cross-repo suite/_docs/10_auth.md write) deferred — outside this
workspace; tracked in deploy_cycle2.md R3 follow-up.

Co-authored-by: Cursor <cursoragent@cursor.com>

SatelliteProvider.IntegrationTests/PerfBootstrap.cs

@@ -21,9 +21,13 @@ internal static class PerfBootstrap
     public static int MintToken()
     {
         string secret;
+        string issuer;
+        string audience;
         try
         {
             secret = JwtTestHelpers.ResolveSecretOrThrow();
+            issuer = JwtTestHelpers.ResolveIssuerOrThrow();
+            audience = JwtTestHelpers.ResolveAudienceOrThrow();
         }
         catch (InvalidOperationException ex)
         {
@@ -35,7 +39,9 @@ internal static class PerfBootstrap
             secret,
             PerfSubject,
             PerfTokenLifetime,
-            new[] { new Claim(PermissionsClaimType, GpsPermission) });
+            new[] { new Claim(PermissionsClaimType, GpsPermission) },
+            issuer: issuer,
+            audience: audience);
 
         Console.Out.Write(token);
         return 0;