Kunde (slug): —
Established: aud is the client-id GUID (not the api://
URI) — that is what AppServer validates. iss carries the
signing-in user's own tid, so AppServer must validate the issuer
against the token rather than against a fixed string. Access rows match on
email, falling back to preferred_username.