fix: eliminate per-request audience catalog copy (CWE-400)

[nihaopaul]

Summary

• Changes Catalog.auds from Vec<String> to Arc<HashSet<String>> — the catalog is built once at refresh time and shared across all concurrent requests via a cheap pointer clone
• Removes Validation::set_audience from the per-request hot path — previously this deep-copied every audience string into a new HashSet before signature verification, allowing unauthenticated requests to drive allocation proportional to catalog size
• Introduces two-phase verification: signature + claims checked first (via jsonwebtoken::decode), audience membership checked after using a single O(1) HashSet::contains lookup against the shared Arc
• Sets validate_aud = false on Validation to suppress jsonwebtoken v11's built-in audience check (which requires audiences to be pre-configured); required_spec_claims still enforces that the aud claim is present in the token

Test plan

• cargo test --workspace — all 46 tests pass
• cargo fmt --all --check — no formatting issues
• cargo clippy --workspace --all-targets -- -D warnings — no warnings

🤖 Generated with Claude Code