refactor: loose client id requirement and accept azp

[gao-sun]

Summary

An update originated from mcp-auth/js#28.

Improved handling of the client_id field in the built-in JWT verifier and added support for the azp (authorized party) field. The logic now falls back to the azp field if client_id is missing or malformed. If neither field is valid, it defaults to an empty string.

[Copilot]

Pull Request Overview

This PR refactors the JWT verification logic to loosen the requirement on the client_id field and support the azp field as a fallback. Key changes include updating the tests to account for different types of client_id values, modifying the verify_jwt function to check for azp if client_id is absent, and updating the type definitions accordingly.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
tests/utils/create_verify_jwt_test.py	Updated tests to verify client_id handling and fallback to azp
mcpauth/utils/_create_verify_jwt.py	Refactored JWT verification logic for client_id/azp fallback
mcpauth/types.py	Updated type definitions and documentation for client_id and azp support

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

📢 Thoughts on this report? Let us know!