refactor(api): one error body, token audiences, contract fixture

readme.md

@@ -77,14 +77,20 @@ To Be Played is split into three repositories:
 Core never issues tokens. It verifies Auth's EdDSA (Ed25519) JWTs with public keys only. It loads them from Auth's
 JWKS by the token's `kid` and loads again when a new `kid` shows up (at most every 10 seconds). Loaded keys stay
 until Core restarts. `JWT_PUBLIC_KEY` is used only until the first JWKS load works. The token comes from Auth's
-`tbp_access` cookie or a `Bearer` header, whichever verifies first. Core reads `userId`, `steamId` and the active
-`role` (missing or unknown = USER) from the claims and grants that role and every lower one
-(`USER < AUDITOR < PLATFORM_ADMIN`).
+`tbp_access` cookie or a `Bearer` header, whichever verifies first. Every token names its kind in `aud`
+(`tbp-login`, `tbp-public-profile`, `tbp-internal`, with `iss=tbp-auth`); a login's `sub` is the user id. Core reads
+`steamId` and the active `role` (missing or unknown = USER) from the claims and grants that role and every lower one
+(`USER < AUDITOR < PLATFORM_ADMIN`). A token without `aud` comes from an Auth from before item 26 (kind in `typ`,
+user id in `userId`) and is still accepted; item 29 removes that path. The claims are pinned in
+`src/test/resources/contract/auth-core-contract.json`, the same file as in Auth; the tests build tokens only from it.
 `POST`, `PUT` and `DELETE` need an `X-TBP-Client` or `Authorization` header (CSRF guard), and CORS allows only the
 frontend origin.
-A token with a `typ` claim (for example a profile ticket) is rejected on normal endpoints; the profile ticket is
+A token for another audience (for example a profile ticket) is rejected on normal endpoints; the profile ticket is
 accepted only by `GET /api/public/profiles/library` in the `X-Profile-Ticket` header.
-`/internal/**` has its own filter chain: it accepts only a service token of Auth (`typ=service`, with `exp`, sent
+Every error answer of a controller has the body `{code, message}` (a 401 or 403 of the security filters has none); a refused request is `400 VALIDATION_FAILED` with
+`fields: [{field, message}]`, a duplicate key `409 CONFLICT`, anything unexpected `500 INTERNAL_ERROR` without details
+(`shared/api/GlobalExceptionController`).
+`/internal/**` has its own filter chain: it accepts only a service token of Auth (`aud=tbp-internal`, with `exp`, sent
 as `Bearer`), never a login, also not in the dev profile. Traefik exposes the path, so the signed token is its
 only guard.