Accept both client ID and application ID URI as valid audiences

[dkhalife]

Problem

VS Code's MCP client acquires tokens from Entra using the app registration's Client ID as the resource identifier, so Entra stamps that GUID as the aud claim. The MCP server only accepted api://task-wizard (the Application ID URI), causing all requests to fail with:

IDX10214: Audience validation failed. Audiences: ''. Did not match: validationParameters.ValidAudience: 'api://'

Fix

• Added TW_ENTRA_CLIENT_ID environment variable
• Changed ValidAudience to ValidAudiences accepting both api://<app-name> and the Client ID GUID

[Copilot]

Pull request overview

This PR updates the MCP server’s Entra JWT audience validation to accept access tokens whose aud claim is either the Application ID URI (e.g. api://task-wizard) or the app registration’s Client ID GUID—matching how VS Code’s MCP client requests tokens.

Changes:

• Read TW_ENTRA_CLIENT_ID at startup and validate it is set.
• Switch JWT validation from ValidAudience to ValidAudiences to allow both the configured audience and client ID.