Keyless login: audience-not-configured branch returns a generic 500 instead of an honest capability-absence response

The login handler (`rs/cyphr-server/src/auth/login.rs`) was fixed to give an honest, structured response when the server has no signing identity at all — a keyless server now returns a clear "this server does not offer login" response instead of a generic 500.

There is a second, narrower branch with the same smell that was left out of that fix: a server whose login *audience* (the service name a signed login payload must name, per SPEC §17.2/§7.3) isn't configured returns a plain 500 internal-error response, rather than the same kind of honest, structured capability-absence response the no-identity case now gets.

This was out of scope for the original fix because that fix's acceptance criterion was scoped specifically to the no-identity case. Worth a small follow-up giving the audience-not-configured case the same honest treatment.

Part of the server production-readiness effort tracked in #23. Discovered during the work tracked in #88.

Start in rs/cyphr-server/src/auth/login.rs and compare the audience-not-configured branch with the existing no-signing-identity response. Update the audience-missing path to return the same kind of honest, structured capability-absence response instead of a generic 500, then exercise that login configuration to verify the response.

Written by the indexing model from the issue text.