fix(security): validate JWT issuer & audience claims per environment (#101)

[peaceshallom37-rgb]

Summary

Validates JWT issuer and audience claims per environment to prevent cross-environment token replay attacks.

Changes

• jwt.strategy.ts: env-driven JWT_ISSUER / JWT_AUDIENCE validation in Passport strategy
• jwt-helper.ts: issuer and audience added to all JWT sign() calls, hubId added to access token payload
• user.interface.ts: hubId field added to JwtPayload interface

Acceptance Criteria

• Cross-environment token rejected
• Issuer/audience validated from env vars with sensible defaults

Closes #101