CVE-2026-30223: OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes

When JWT authentication is configured using either:

• authJwtPubKeyPath (local RSA public key), or
• authJwtHmacSecret (HMAC secret),

the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service.