fix(paperless-ai): ask for no project audience, so aud names the caller

The gateway compares the token audience with its allow-list of client ids. The scope
carried urn:zitadel:iam:org:project🆔<project>:aud, so every token said
aud = [396757796898471937] and the gateway answered

  token validation failed: audience not allowed: [396757796898471937]

With plain openid the audience is the machine user, which is the entry that exists on
the list.

k8s/apps/paperless/paperless-ai.yaml

@@ -65,7 +65,12 @@ spec:
             - --user-id=397072668735570071
             - --key-id=397072674272051351
             - --key-file=/var/run/llm-key/key
-            - --scope=openid urn:zitadel:iam:org:project:id:396757796898471937:aud
+            # No project audience. ZITADEL puts the requested audience in `aud`, and
+            # the gateway compares `aud` with its allow-list of client ids. Asking for
+            # the project id made every token carry the project, so the gateway
+            # answered "audience not allowed: [396757796898471937]". With plain
+            # `openid` the token names its caller, which is the entry that exists.
+            - --scope=openid
             - --out=/app/data/llm_token.txt
           volumeMounts:
             - {name: paperless-ai-data, mountPath: /app/data}