Fix token audience validation in separate auth mode

The auth server's /introspect endpoint now correctly sets the 'aud' field
to the resource server URL (BASE_URI) instead of the client ID. This ensures
proper audience validation when the MCP server verifies tokens in separate mode.

- Import BASE_URI in auth server
- Set aud to BASE_URI in introspection response
- Fixes "Token was not issued for this resource server" error

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

package.json

@@ -15,7 +15,7 @@
     "dev:with-separate-auth": "concurrently -n \"AUTH,MCP\" -c \"yellow,cyan\" \"npm run dev:auth-server\" \"npm run dev:separate\"",
     "build": "tsc && npm run copy-static",
     "copy-static": "mkdir -p dist/src/static && cp -r src/static/* dist/src/static/",
-    "lint": "eslint src/ auth-server/",
+    "lint": "eslint src/ auth-server/ shared/",
     "test": "NODE_OPTIONS=--experimental-vm-modules jest",
     "test:integrated": "AUTH_MODE=integrated npm test",
     "test:separate": "AUTH_MODE=separate npm test",