fix(auth): validate issuer, audience and expiry on the token response; tell users to retry a rejected code

[jzhao234]

TLDR

Review follow-ups on the central-auth client (#17), cherry-picked onto main because #17 merged while the review was in flight. Explorer now checks that the identity it receives was minted by the issuer it asked, for this client, and is still within its window; a consumed or superseded sign-in code tells the user to try again instead of blaming an outage; two constant-time compares can no longer crash on non-ASCII input; and the bootstrap writes .env owner-only.

Problem

• exchange() trusted sub, email and nonce and ignored iss, aud and exp. Over an authenticated TLS backchannel this is a misconfiguration risk rather than an attack path, but a response minted for another client or replayed after its window would still have created a session.
• Every token-endpoint failure became a 502 "authentication service is unavailable". The auth service answers 400 invalid_grant for a consumed, expired, or superseded code, which two tabs signing in at once produce routinely. That is a retry, not an outage.
• hmac.compare_digest raises TypeError on str arguments containing non-ASCII characters. state comes from the callback query string, so any visitor could turn the callback into a 500. The nonce compare had the same shape.
• .env was written 0640 although it now holds the client secret, the session secret, and AWS keys.

Fix

• exchange() requires iss to equal the configured issuer origin, aud to equal the client id, and exp to be an integer not more than 60 seconds in the past (assertions live five minutes). Booleans are rejected as exp.
• New CodeExchangeRejectedError for HTTP 400 from the token endpoint; the callback maps it to 400 "Sign-in expired. Try again." 401 and 5xx stay 502.
• State and nonce compares operate on UTF-8 bytes.
• bootstrap.sh writes .env with mode 0600.

Tests

• New: wrong aud, wrong iss, expired, string and boolean exp are rejected; 10 seconds of skew is tolerated; a non-ASCII nonce is rejected rather than raising; HTTP 400 is CodeExchangeRejectedError while 401 is a plain CentralAuthError; the callback returns 400 with "Try again" for a rejected code and never exchanges a code when the state is non-ASCII.
• Updated: the two unit-test fakes return iss, aud and exp like the real service.
• Ran: pytest -q (98 passed), ruff check, ruff format --check, bash -n and shellcheck on bootstrap.sh, update.sh and explorer-cli.

Review notes and the items left for the owner are on #17.