Add corporate_id check to authentication middleware

[UsamaSadiq]

Description

Add tenant isolation enforcement to Outline's authentication middleware. When SMB_CORPORATE_ID is configured, the fwd: token path in validateAuthentication() decodes the x-auth-request-access-token JWT payload and verifies that custom:corporate_id matches. Individual (non-corporate) tokens and mismatched corporate tokens are rejected with AuthenticationError.

Enforcement is opt-in: when SMB_CORPORATE_ID is unset, the check is skipped entirely.

Testing

• Set SMB_CORPORATE_ID=<uuid> in .env
• Verify matching corporate users can access Outline normally
• Verify mismatched corporate users get authentication error
• Verify unset SMB_CORPORATE_ID allows all users (backward compatible)