feat: enforce realtime delegation audience on the message socket

The socket used to accept any valid token, so a full REST/actor token could open the
live stream. Now it can require a narrowly-scoped delegated token (aud=iios-message),
so a leaked socket token can't drive privileged REST, and vice-versa.

- MessagePrincipal gains `audience`, surfaced from both verify paths (OIDC aud, and the
  app-token `aud` claim).
- message.gateway: when IIOS_REALTIME_AUDIENCE is set, handleConnection accepts only a
  token whose aud matches (opt-in, like IIOS_REQUIRE_ATTESTATION; unset = no change).
- spec: verifier surfaces aud; gateway accepts iios-message, rejects iios-core / no-aud
  when enforcing, passes through when off.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-service/src/platform/session.verifier.ts

@@ -135,6 +135,7 @@ export class SessionVerifier implements OnModuleInit {
       orgId: entry.orgId,
       tenantId: undefined,
       displayName: meta.full_name ?? meta.name ?? email ?? userId,
+      audience: typeof payload.aud === 'string' ? payload.aud : entry.audience,
     };
   }
 
@@ -159,6 +160,7 @@ export class SessionVerifier implements OnModuleInit {
       orgId: payload.orgId ? String(payload.orgId) : `org_${appId}`,
       tenantId: payload.tenantId ? String(payload.tenantId) : undefined,
       displayName: payload.name ? String(payload.name) : undefined,
+      audience: typeof payload.aud === 'string' ? payload.aud : undefined,
     };
   }