Make consequences of empty JWT IdP audience more visible

Which Problems Are Solved

Since the fix for CVE-2026-55669 (GHSA-g5h5-m4hm-xjrr), a JWT IdP validates the aud claim only when an audience is configured. Leaving the field empty is valid (for backward compatibility) and means the aud claim is not checked at all — a correctly signed token issued for a different client of the same issuer is accepted. This is documented, but easy to miss: the Console shows the field as just "optional", and the docs mention the behavior only briefly.

How the Problems Could Be Solved

Keep the audience optional (no breaking change), but make the implication of leaving it empty explicit:

• Console: show an info/warning hint on the JWT IdP form when the audience field is empty, e.g. "Without an audience, ZITADEL accepts any valid token from this issuer, regardless of which application it was issued for. Setting an audience is strongly recommended."
• Docs: expand the Audience section in the JWT IdP guide with a security note explaining the confused-deputy risk of an empty audience, instead of the current one-line remark.
• Optionally, add the same hint to the API field descriptions (admin/management/v2 IdP protos) so it surfaces in generated API docs.

Additional Context

Follow-up hardening from the CVE-2026-55669 fix (999e2bbc81b56fca693ccc87a863fdfc182b1316). Reported externally as a residual-risk observation; no new vulnerability, since the behavior is intentional and documented.