Fix Convex auth provider mismatch for Clerk tokens

[codybmenefee]

Summary

• add missing convex/auth.config.ts with Clerk provider configuration
• configure a preferred OIDC provider for aud=convex tokens
• include a compatibility custom JWT provider for Clerk-issued tokens during migration
• document CLERK_JWT_ISSUER_DOMAIN env requirement in app env docs

Why
Prod logs show Convex rejecting authenticated websocket sessions with:
No auth provider found matching the given token
That means Convex had no matching auth provider configuration for Clerk JWTs.

Validation

• cd app && npx eslint src/main.tsx convex/auth.config.ts convex/lib/agentAccess.ts convex/agentAdmin.ts convex/users.ts
• cd app && pnpm run build