feat(authproxy): use CLIENT_ID for per-agent inbound audience validation

[huang195]

Summary

Replace the EXPECTED_AUDIENCE env var with the agent's CLIENT_ID (from /shared/client-id.txt) for inbound JWT audience validation. This makes audience validation per-agent by construction.

Problem

EXPECTED_AUDIENCE was either:

• Not set (most demos) — no audience check, tokens interchangeable across agents
• Set at namespace level — same value for all agents, tokens still interchangeable

A token intended for one agent could be used on any other agent in the same namespace.

Solution

Use CLIENT_ID from /shared/client-id.txt as the expected audience. This file is written by the operator (PR #247) or client-registration sidecar and contains the agent's unique Keycloak client ID:

• SPIRE: spiffe://trust-domain/ns/namespace/sa/service-account
• Non-SPIRE: namespace/workload-name

The audience scope created during client registration ensures platform tokens (kagenti UI) include this value in their aud claim.

Changes

• go-processor/main.go: Use config.ClientID instead of EXPECTED_AUDIENCE env var
• Demo configmaps: Remove EXPECTED_AUDIENCE references
• Demo docs: Update to reflect automatic audience validation

Impact on existing demos

All demos verified — no breakage:

• Weather Agent: tokens use agent's own client → correct aud
• GitHub Issue: tokens use agent's own client → correct aud
• Webhook: tokens use agent's own client → correct aud
• Single-Target: tokens use agent's own client → correct aud
• Multi-Target: inbound not tested in script; outbound unaffected

Test plan

• Webhook demo: inbound validation rejects tokens without agent's client ID in aud
• Weather agent demo: UI chat works (platform token has audience scope)
• GitHub issue demo: Alice/Bob flows work with per-agent audience check
• Tokens from admin-cli (without audience scope) are correctly rejected

Generated with Claude Code