auth: validAudiences for the MCP resource (RFC 8707/9068)

MCP clients send resource=<mcp url>; Better Auth rejected it because the default
allowed audience is only baseURL. List the MCP resource so the token exchange
succeeds and the access token becomes a JWT with aud=resource.

src/auth.ts

@@ -68,6 +68,17 @@ export const auth = betterAuth({
     oauthProvider({
       // Absolute URL: some OAuth clients resolve a relative login redirect
       // against their own origin, landing on a blank page.
+      // MCP clients send the RFC 8707 `resource` (the MCP server URL); it must
+      // be an allowed audience or the token exchange is rejected. Listing it
+      // here also makes the access token a JWT with aud=resource (RFC 9068),
+      // which the MCP server verifies.
+      validAudiences: (
+        process.env.VALID_AUDIENCES ??
+        "https://intervalsicu.farhoodlabs.com,https://intervalsicu.farhoodlabs.com/,https://intervalsicu.farhoodlabs.com/mcp"
+      )
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean),
       loginPage: `${baseURL}/login`,
       // Required by the type; not shown because skipConsent auto-approves — for
       // a personal MCP connector, signing in *is* the authorization.