Add back-channel client credentials flow to AuthProxy

[Copilot]

Summary

Adds service-owned client-credentials support to AuthProxy via a back-channel verification flow. AuthProxy can now mint scoped bearer tokens from /.cratis/token and validate them on subsequent proxied requests.

Release notes are generated from this description:

• Adds back-channel client-credentials token issuance and route-scoped bearer validation for proxied services (Resolve client credentials - back channel #51)
• Documents the per-service configuration and verification contract for downstream credential checks (Resolve client credentials - back channel #51)

Added

• POST /.cratis/token to exchange verified client credentials for AuthProxy-issued bearer tokens (Resolve client credentials - back channel #51)
• Per-service ClientCredentials configuration with RoutePrefix and VerificationPath (Resolve client credentials - back channel #51)
• Bearer-token authentication for AuthProxy-issued client-credentials tokens scoped to service and route prefix (Resolve client credentials - back channel #51)
• Specs covering successful issuance, rejected credentials, and token reuse on proxied routes (Resolve client credentials - back channel #51)

Changed

• Authentication scheme selection now composes cookie auth, AuthProxy-issued bearer tokens, and optional external JWT bearer auth without breaking existing flows (Resolve client credentials - back channel #51)
• Auth bootstrap path classification now includes the token endpoint so machine-to-machine requests bypass interactive login behavior (Resolve client credentials - back channel #51)
• Service configuration docs now describe the downstream verification payload and token contract (Resolve client credentials - back channel #51)

Fixed

• Prevented service/client-credential verification from being coupled to external identity providers by moving credential ownership to the downstream service (Resolve client credentials - back channel #51)
• Ensured AuthProxy-issued bearer tokens are only accepted for the configured service and route prefix they were minted for (Resolve client credentials - back channel #51)

Removed

Security

• Strips client-credentials token usage to the configured service/route scope instead of accepting a bearer token generically across proxied routes (Resolve client credentials - back channel #51)

Deprecated

Example

{
  "Cratis": {
    "AuthProxy": {
      "Services": {
        "portal": {
          "Backend": { "BaseUrl": "http://portal-api:8080/" },
          "ClientCredentials": {
            "RoutePrefix": "/api",
            "VerificationPath": "/.cratis/client-credentials/verify"
          }
        }
      }
    }
  }
}