fix: disable JWT inbound claim mapping for Zitadel sub claim

.NET remaps "sub" to a long URI claim type by default, causing
User.FindFirst("sub") to return null. MapInboundClaims=false
preserves the original claim names.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/Program.cs

@@ -20,6 +20,7 @@ builder.Services.AddAuthentication("Bearer")
     {
         options.Authority = builder.Configuration["Zitadel:Issuer"] ?? "https://auth.kuns.dev";
         options.Audience = builder.Configuration["Zitadel:ClientId"] ?? "";
+        options.MapInboundClaims = false; // Prevent .NET from remapping "sub" to long URI
         options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
         {
             ValidateIssuer = true,