Todo UI

Your token should match the Todo resource.

Create a few items, then try the same API with the wrong audience to see the MCP-oriented challenge behavior.