codegen + harden audience config loader

- Regenerate deepcopy functions for new types
- Use strict YAML unmarshal to catch typos
- Reject empty or duplicate audience entries

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: patjlm

pkg/api/zz_generated.deepcopy.go

@@ -322,11 +322,17 @@ func AllowedAudiencesConfig(configPath string) (api.AllowedAudiencesMap, error)
 	}
 
 	var audiencesList []api.AllowedAudienceDetails
-	if err = yaml.Unmarshal(configContents, &audiencesList); err != nil {
+	if err = yaml.UnmarshalStrict(configContents, &audiencesList); err != nil {
 		return nil, fmt.Errorf("failed to unmarshall allowed audiences config: %w", err)
 	}
-	allowedAudiencesMap := make(api.AllowedAudiencesMap)
-	for _, a := range audiencesList {
+	allowedAudiencesMap := make(api.AllowedAudiencesMap, len(audiencesList))
+	for i, a := range audiencesList {
+		if a.Audience == "" {
+			return nil, fmt.Errorf("allowed audiences config entry %d: audience must not be empty", i)
+		}
+		if _, exists := allowedAudiencesMap[a.Audience]; exists {
+			return nil, fmt.Errorf("allowed audiences config: duplicate audience %q", a.Audience)
+		}
 		allowedAudiencesMap[a.Audience] = a
 	}
 	return allowedAudiencesMap, nil