fix: accept trailing slash OIDC issuers

[mikemikimike]

Summary / Problem

Authentik publishes application-scoped OIDC issuers with a trailing slash. Inkvoice normalizes OIDC_ISSUER_URL by removing that slash, then passes only the normalized value to jose for exact iss validation. As a result, every Authentik login fails after the callback with an issuer mismatch.

Changes

• Accept the normalized issuer and its trailing-slash representation during ID token validation.
• Keep exact issuer matching; other issuer values remain rejected.
• Add a regression test using the existing HTTPS OIDC test server and a signed token whose iss includes the trailing slash.

Tests

• OPENSSL_CONF=NUL bun test packages/backend/src/tests/oidc-service.test.ts — 16 tests passed.
• bun run typecheck — passed.
• bun run build — passed.
• bunx biome lint packages/backend/src/services/oidc.service.ts packages/backend/src/tests/oidc-service.test.ts — passed.
• Independent runs of the 69 repository test files: 68 passed. The existing demo-seed.test.ts has a Windows-only SQLite cleanup failure because its same-file fresh-database helper cannot remove an open database; the OIDC test file passes independently.

The full repository bun run lint currently reports pre-existing CRLF formatting diagnostics across the checkout; the changed files pass Biome lint and the commit hook formatted only those two files.

Compatibility / Security

This preserves the existing discovery-document normalization and continues using jose's exact issuer allowlist. It does not introduce domain or substring matching.

Issue link

Closes #11
#11