Token-layer hardening on top of the phase 3 JWKS multi-key work.
Addresses the OIDC review findings listed below.

- C2: SignJWTToken now stamps the `kid` JOSE header with ClientID so
  verifiers (including /.well-known/jwks.json) can pick the right
  published JWK during manual key rotation. ParseJWTToken honors the
  header — primary vs secondary vs legacy try-both fallback — via the
  new parseJWTWithKidSelection helper.
  (internal/token/jwt.go SignJWTToken, parseJWTWithKidSelection)

- H1 / Logic #7: Secondary-key fallback no longer fires for every
  error. It is now gated on errors.Is(err, jwt.ErrTokenSignatureInvalid)
  so malformed tokens, alg mismatches, and claim errors short-circuit.
  Both the primary and combined errors are wrapped with %w so callers
  can use errors.Is (Logic #13). Successful secondary verification
  logs a single debug line ("token verified by secondary key") as a
  rotation signal — no token contents are logged.
  (internal/token/jwt.go parseJWTWithKidSelection lines ~174-200)

- Logic #4: `iat` is optional per RFC 7519 §4.1.6 and OIDC Core for
  non-self-issued tokens. ParseJWTToken no longer treats a missing iat
  as an error; present iat is still normalized to int64.
  (internal/token/jwt.go ParseJWTToken lines ~229-238)

- M4: `aud` comparison now accepts arrays. New helper
  token.AudienceMatches handles string, []string, []interface{}, and
  jwt.ClaimStrings (plus nil/empty). Used in both ValidateJWTClaims and
  ValidateJWTTokenWithoutNonce.
  (internal/token/audience.go, internal/token/jwt.go ValidateJWTClaims)

- M5: ValidateJWTClaims now requires sub == User.ID for OIDC-visible
  tokens (access, refresh, ID). The legacy email-as-sub fallback is
  restricted to verification token types (signup, magic-link,
  forgot-password, invite, OTP) where the user ID does not yet exist.
  OIDC Core §2 requires sub to never be reassigned.
  (internal/token/jwt.go ValidateJWTClaims, verificationTokenTypes)

- New helper ParseIDTokenHint: verifies the signature of an
  id_token_hint (OIDC Core §3.1.2.1, RP-Initiated Logout §2) without
  running the exp/nbf/iat validators, as the OP SHOULD accept expired
  hints. Reuses the kid-aware key selection from ParseJWTToken.
  (internal/token/id_token_hint.go)

- AMR / ACR / ResponseType constants: new internal/constants/amr.go
  and internal/constants/acr.go define the RFC 8176 amr values
  (AMRPassword, AMROTP, AMRFederated, AMRMFA) and the OIDC Core §2
  baseline acr value (ACRBaseline = "0"). Replaces the string literals
  in auth_token.go loginMethodToAMR (~L65-83) and CreateIDToken
  (~L478).

Tests: unit tests for AudienceMatches (4 shapes + nil/empty), kid
header stamping, legacy kid-less fallback, direct secondary-kid
selection, signature-only fallback (no retry on malformed), wrapped
error propagation via errors.Is, optional iat, strict sub for OIDC
tokens, email-as-sub allowed for verification tokens, ParseIDTokenHint
accept-expired / reject-bad-sig / reject-malformed / legacy fallback.

make test-sqlite: all packages PASS.