Support multiple audiences per auth provider

### Problem

When using the same Auth0 domain (issuer) for multiple applications with different client IDs, only the first registered provider is used for token validation.

**Example scenario:**
- MJExplorer app uses Auth0 client `abc123`
- MJCentral app uses Auth0 client `xyz789`
- Both apps use the same Auth0 domain `example.us.auth0.com`

**Current config:**
```js
authProviders: [
{
name: 'Auth0',
type: 'auth0',
issuer: 'https://example.us.auth0.com/',
audience: 'abc123', // MJExplorer client
...
},
{
name: 'Auth0UI',
type: 'auth0',
issuer: 'https://example.us.auth0.com/',
audience: 'xyz789', // MJCentral client
...
}
]
```

**Result:** Tokens from MJCentral fail with `jwt audience invalid. expected: abc123` because `AuthProviderFactory.getByIssuer()` returns the first provider matching the issuer and caches it.

### Root Cause

- `IAuthProvider.audience` is typed as `string`, not `string | string[]`
- Provider lookup is by issuer only - first match wins
- The underlying `jsonwebtoken` library supports `audience: string | string[]` for verification

### Proposed Solution

Update `IAuthProvider` and `BaseAuthProvider` to support multiple audiences:

```typescript
// IAuthProvider.ts
audience: string | string[];

// BaseAuthProvider.ts
validateConfig(): boolean {
const hasAudience = Array.isArray(this.audience)
? this.audience.length > 0
: !!this.audience;
return !!(this.name && this.issuer && hasAudience && this.jwksUri);
}
```

This would allow a single provider to validate tokens from multiple OAuth clients sharing the same issuer.

### Workaround

Currently the only workarounds are:
1. Use the same Auth0 client ID for all apps (less isolation)
2. Create separate Auth0 tenants with different domains (more infrastructure)