fix(fm): refuse partner tokens not issued for us

Inbound EWBI tokens were checked for signature, issuer, expiry and the
fed-mgmt scope, but not the audience: a token our Keycloak minted for
another client in the federation realm would have been accepted. The
Helm chart already adds an audience mapper (aud: federation-manager) to
every partner client and documents that FM checks it; FM now does.

FM_KEYCLOAK_AUDIENCE sets the expected value (default
federation-manager), and a token without it, or naming only other
services, gets the usual 401 authentication-failed. The CI and fixture
realms gain the same mapper, so the integration tests get the tokens a
deployment issues.

Also pins that a refused InstallApp leaves no install record: the
delete of a refused attempt relies on FM answering 404 to SRM's
instance read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>