fix(auth): resolve JWT InvalidSignatureError and improve frontend UX

- Fix auth by using idToken fallback when accessToken audience mismatches
- Add PyJWT verification with audience-aware token selection in frontend
- Source health: track last_attempt_time and error status per source
- Frontend: fix modal outside x-data scope, add circular-safe JSON stringify
- Frontend: support multi-select service filter with All/None toggles
- Frontend: improve filter layout into organized rows
- Frontend: fix text overflow and result pill colors (success/succeeded)
- Intune: normalize application actors (auditActorType=Application)
- Add cache-control middleware for HTML/API responses
- Update tests for multi-service filtering and source health

backend/sources/intune_audit.py

@@ -45,20 +45,27 @@ def _normalize_intune(e: dict) -> dict:
     actor = e.get("actor", {}) or {}
     target = e.get("resources", [{}])[0] if e.get("resources") else {}
 
+    initiated_by: dict = {"user": {}}
+    if actor.get("auditActorType") == "Application" or actor.get("applicationDisplayName"):
+        initiated_by["application"] = {
+            "id": actor.get("applicationId"),
+            "displayName": actor.get("applicationDisplayName"),
+        }
+    else:
+        initiated_by["user"] = {
+            "id": actor.get("userId"),
+            "userPrincipalName": actor.get("userPrincipalName"),
+            "displayName": actor.get("userName"),
+            "ipAddress": actor.get("ipAddress"),
+        }
+
     return {
         "id": e.get("id"),
         "activityDateTime": e.get("activityDateTime"),
         "category": e.get("category") or "Intune",
         "activityDisplayName": e.get("activity") or e.get("activityType"),
         "result": e.get("activityResult") or e.get("result"),
-        "initiatedBy": {
-            "user": {
-                "id": actor.get("userId"),
-                "userPrincipalName": actor.get("userPrincipalName"),
-                "displayName": actor.get("userName"),
-                "ipAddress": actor.get("ipAddress"),
-            }
-        },
+        "initiatedBy": initiated_by,
         "targetResources": [
             {
                 "id": target.get("id"),