[mcpx-webapp] ID aware mcp server wiring

[EliavLunar]

This PR adds the helm wiring so hosted MCP servers can verify user identity tokens without manual configuration.

The hive-controller deployment now passes three new env vars (MCPX_AUTH_JWKS_URI, MCPX_AUTH_JWT_ISSUER, MCPX_AUTH_JWT_AUDIENCE) which flow down to mcpx pods and into child stdio processes. All values derive automatically from existing chart config (auth ingress domain, release name) — no new values.yaml fields needed.

• JWKS URI uses the external auth domain (not in-cluster) because Docker-based hosted servers run in their own network namespace and can't resolve cluster-internal DNS
• JWT audience (mcpx) is now single-sourced via a shared helper, used by both auth-bff (JWT_AUDIENCE) and controller (MCPX_AUTH_JWT_AUDIENCE) — previously OIDC_AUDIENCE only lived in the user-created secret
• Refactored the router's OIDC_JWKS_URI to use the same authJwksUri helper (in-cluster default, since the router runs inside the cluster)

Companion to TheLunarCompany/lunar-private#2834