Struct ProviderEntry 

pub struct ProviderEntry {
    pub authenticator: Arc<dyn TokenAuthenticator>,
    pub audience_binding: Option<AudienceBinding>,
}

A single named authentication provider: its token authenticator plus the (reserved) audience binding. audience_binding is None in Phase 1 and is populated in Task 1.6.

Invariant: JWT-backed providers MUST populate issuers in their binding. A binding with audiences but empty issuers silently drops the validator’s constructor-fixed issuer check on the kernel path (the request’s non-empty audience set bypasses both constructor checks via REPLACEMENT semantics).

Fields

authenticator: Arc<dyn TokenAuthenticator>

audience_binding: Option<AudienceBinding>