fix(mcp): disable audience verification in resolve_mcp_jwt

Team JWTs include `aud=mnemosyne` while per-turn JWTs omit `aud`
entirely. Since `iss` + `typ` already partition the two token
populations, explicitly skip audience verification to avoid rejecting
valid tokens.

Also expand test coverage for the MCP auth surface to exercise all
three credential types (opaque MCPToken, per-turn JWT, team JWT),
including replay cache behavior and Neo4j-backed library resolution
via mocked cypher queries.

mnemosyne/mcp_server/auth.py

@@ -222,7 +222,14 @@ def resolve_mcp_jwt(token_string: str) -> dict:
             secret,
             algorithms=["HS256"],
             leeway=_JWT_LEEWAY_SECONDS,
-            options={"require": ["exp", "iat", "iss", "sub", "jti"]},
+            options={
+                "require": ["exp", "iat", "iss", "sub", "jti"],
+                # Team JWTs carry ``aud=mnemosyne`` for informational
+                # purposes; per-turn JWTs omit ``aud`` entirely. We
+                # don't enforce either shape because ``iss`` + ``typ``
+                # already partition the two token populations.
+                "verify_aud": False,
+            },
             # ``issuer=`` accepts ``str | Iterable[str]`` and raises
             # ``InvalidIssuerError`` if the claim is outside the set.
             issuer=list(_JWT_ISS_VALUES),