Authly::AuthorizationCode

Patch: Grant#access_token derives the token's sub from grant_strategy.user_id, but upstream AuthorizationCode never overrides user_id (it returns the module default, nil), so the authorization-code grant mints a token with a random sub. The legacy Ruby service (Doorkeeper::JWT) sets sub to the resource owner's id — and our ClaimsProvider relies on sub being a real user id to attach the aud + u{n,e,p,r} claims. We recover the user_id that was captured into the authorization code when it was minted (see the Code#jwt patch above).