Wire user-engine HTTP /me for member provisioning (CSOC-WP-0002-T04)

HttpUserEngineClient uses trusted-proxy claims against live user-engine.
Offline stub when URL/secret unset. Align default tenant with KeyCape
tenant:coulomb; map OIDC tenant/principal_type/groups into the envelope.

coulomb_social/templates/identity/dev_login.html

@@ -23,6 +23,9 @@
     <label>Preferred username
       <input type="text" name="preferred_username" value="dev">
     </label>
+    <label>Tenant claim
+      <input type="text" name="tenant" value="{{ default_tenant }}">
+    </label>
     <p style="margin-top:1.25rem;">
       <button class="btn" type="submit">Establish session</button>
     </p>