feat(server): add resource option to verifyClerkToken for audience binding

[djgould]

Description

verifyClerkToken(auth, token, { resource }) now fails closed when the token's aud does not include resource, for JWT and opaque tokens alike, and sets resource on the returned AuthInfo. Without resource, behavior is unchanged.

• Relies on the aud field of the OAuth auth object added to @clerk/backend in feat(backend): enforce audience binding for OAuth access tokens javascript#9794. The @clerk/backend devDependency here is still v2, so aud is read structurally; bump it and drop the cast once that ships. With an older @clerk/backend, setting resource rejects every token.
• The Next.js README example passes resource derived from the request origin.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}