Access tokens for User.Read scope have audience=graph.microsoft.com,
but the backend validates audience=CLIENT_ID. ID tokens always have
audience=CLIENT_ID so they validate correctly.
Also add upn claim fallback for email extraction from ID token.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>