[SAY-5]

Authentik publishes an application issuer with a trailing slash, and the same value is the iss of every id_token it signs. env.ts strips that slash from OIDC_ISSUER_URL and discoverOidc() already allows for it when checking the discovery document, but validateIdToken() passed the stripped value to jwtVerify, whose exact comparison then rejects every login with unexpected "iss" claim value. This verifies the token against doc.issuer instead, which discovery has already matched to the configured issuer, so a provider's own form is accepted without loosening the check.

Fixes #11