Wire user-engine HTTP /me for member provisioning (CSOC-WP-0002-T04)

HttpUserEngineClient uses trusted-proxy claims against live user-engine.
Offline stub when URL/secret unset. Align default tenant with KeyCape
tenant:coulomb; map OIDC tenant/principal_type/groups into the envelope.

coulomb_social/templates/core/app_home.html

@@ -12,6 +12,7 @@
       <dt>Issuer</dt><dd>{{ principal.issuer }}</dd>
       <dt>Subject</dt><dd>{{ principal.subject }}</dd>
       <dt>user-engine id</dt><dd>{{ principal.user_engine_user_id }}</dd>
+      <dt>user-engine source</dt><dd>{{ principal.user_engine_source|default:"—" }}</dd>
     </dl>
   </div>
 {% endblock %}

coulomb_social/templates/identity/dev_login.html

@@ -23,6 +23,9 @@
     <label>Preferred username
       <input type="text" name="preferred_username" value="dev">
     </label>
+    <label>Tenant claim
+      <input type="text" name="tenant" value="{{ default_tenant }}">
+    </label>
     <p style="margin-top:1.25rem;">
       <button class="btn" type="submit">Establish session</button>
     </p>