fix: name the claim when JWT aud, iss, or nbf validation fails

[mandarini]

A JWT that fails a claim check used to reject with the generic "a registered claim failed validation" and a hint about the server clock. The claim-validation branch now reads the claim and reason jose reports: a claim with the wrong type is reported as malformed whatever its name, a mismatched or missing aud / iss names the claim and the hint points at the audience / issuer option, since #160 made those the first checks driven by server configuration, a future nbf keeps its clock hint, and any other claim is named with a generic hint. An empty audience or issuer array now hits the same empty-option guard as an empty string instead of surfacing as a mismatch. The status stays 401 and the failure kind stays token, because the same jose error covers a mistyped option and a token from another project. Nine tests cover the new branches, and the reason table in docs/error-handling.md lists every message the code emits.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@supabase/server@171

commit: 2a7fcf0