Wire user-engine HTTP /me for member provisioning (CSOC-WP-0002-T04)

HttpUserEngineClient uses trusted-proxy claims against live user-engine.
Offline stub when URL/secret unset. Align default tenant with KeyCape
tenant:coulomb; map OIDC tenant/principal_type/groups into the envelope.

coulomb_social/templates/core/app_home.html

@@ -12,6 +12,7 @@
       <dt>Issuer</dt><dd>{{ principal.issuer }}</dd>
       <dt>Subject</dt><dd>{{ principal.subject }}</dd>
       <dt>user-engine id</dt><dd>{{ principal.user_engine_user_id }}</dd>
+      <dt>user-engine source</dt><dd>{{ principal.user_engine_source|default:"—" }}</dd>
     </dl>
   </div>
 {% endblock %}