chore(security)!: drop the userId and typ claims and tokens without aud

readme.md

@@ -43,8 +43,7 @@ To Be Played is split into three repositories:
   tile is shown), `profileStats` the stat groups of the `STATS_` tiles. The user's dashboard layout
   (`dashboard_tiles`, NULL = never changed) is stored the same way. The ticket is not a login: every token names
   its kind in `aud` (`tbp-login`, `tbp-public-profile`, `tbp-internal`, `iss=tbp-auth`), and both services check it.
-  A login's `sub` is the user id; the email is in no token. Until item 29 the tokens also carry the claims of before
-  item 26 (`userId`, `typ`), so an older Core still reads them. The claims are pinned in
+  A login's `sub` is the user id; the email is in no token. A token without `aud` is refused. The claims are pinned in
   `src/test/resources/contract/auth-core-contract.json`, the same file as in Core
   (`ToBePlayed-Deployment/scripts/check-contract.sh` compares both).
 - Errors: every error answer of a controller has the body `{code, message}` (a 401 or 403 of the security filters has none); a refused request is `400 VALIDATION_FAILED` with