feat(auth): bind signed request signatures to audience (closes #1462)

[Nanle-code]

Summary

Binds the v1 signed-request canonical payload to the deployment audience,
closing the last gap identified in #1462. The canonicalizer already scoped
signatures to version, HTTP method, canonical route, and body digest — this
adds the missing audience field from the issue's proposed payload
(version, method, route, body hash, nonce, issued-at, audience) and backs
every binding property with an end-to-end cryptographic test, not just
string comparison.

Changes

• src/server/api/auth/signed-request.ts: add x-stealth-audience to
  SIGNED_REQUEST_HEADERS so it's folded into the canonical string like the
  other signed headers, and add validateSignedRequestAudience() — a
  bounded active-audience-set check (mirrors validateAuthVersion) so a
  signature scoped to one deployment (e.g. staging) can't be replayed
  against another that trusts the same key.
• test-fixtures/auth/signed-request-v1.json: regenerated with a fresh
  Ed25519 keypair, x-stealth-audience on every vector, and a new
  audience_mismatch vector (signature is cryptographically valid, but
  scoped to the wrong deployment).
• tests/unit/api/auth/signed-request-binding.test.ts (new): signs one
  base request with a real Ed25519 key, then proves verification actually
  fails once method, route, query, body, or audience changes — and still
  succeeds for equivalent re-encodings (reordered query params, header
  casing/whitespace differences).
• tests/unit/api/auth/signed-request-vectors.test.ts: exercises the
  new audience vector and asserts validateSignedRequestAudience against
  the fixture's accepted audience.
• docs/security/api-authentication-v1.md: documents the new header,
  canonical-string line, verification-order step, and error table entry.

Acceptance criteria (#1462)

• A signature for one method cannot authorize another method
• A signature for one route cannot authorize another route
• Changing the body invalidates the signature
• Canonicalization fixtures are deterministic across equivalent requests

Out of scope

This is the canonicalization primitive only. src/server/api/context.ts
still authenticates purely off the x-stealth-address header — actual
signature verification is not yet wired into live route handlers. That gap
is already tracked separately (see the it.fails regressions in
tests/unit/api/security.regression.test.ts, issue #1555).

Test plan

• npx tsc --noEmit — clean
• npx eslint on changed files — clean
• npx vitest run — 141 files / 1677 passed (+ 3 pre-existing,
  unrelated it.fails markers for Add API security regression tests for authentication and authorization bypasses #1555)

Closes #1462