Document tenant claim ownership and prove registration binding

Answers the GLAS-WP-0015 tenant-alignment request. The JWT tenant is
tenant:coulomb for all four reviewed service registrations; the approval store
tenant and the policy tenant belong to other owners and KeyCape does no
normalization between them. No mapping is invented and no live registration
changes.

Adds regression tests proving the tenant claim is bound at registration and is
not influenced by request parameters, that distinct registrations never carry
each other's tenant, and that human tokens fall back to the platform tenant
rather than an empty claim.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 713576@bnt-lap001
Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6

src/internal/server/oidc/tenant_test.go

@@ -0,0 +1,106 @@
+package oidc_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"keycape/internal/domain"
+	"keycape/internal/server/oidc"
+)
+
+// The tenant claim is bound at registration time. KeyCape emits exactly the
+// registered value and performs no mapping between tenant vocabularies used by
+// consuming resource servers (approval stores, policy subjects). See
+// docs/tenant-claim-contract.md.
+
+func TestServiceTenantIsBoundToRegistrationAndIgnoresRequestParameters(t *testing.T) {
+	h := serviceTokenHandler(t)
+	req := tokenRequest(url.Values{
+		"grant_type":  {"client_credentials"},
+		"scope":       {"finance.qonto.read"},
+		"tenant":      {"tenant:platform"},
+		"tenant_hint": {"platform"},
+	})
+	req.SetBasicAuth("rapp-qonto", "test-service-secret")
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status %d: %s", w.Code, w.Body.String())
+	}
+	token := decodeTokenResponse(t, w.Body.String())["access_token"].(string)
+	claims := parseJWTPayload(t, token)
+	if claims["tenant"] != "tenant:friendly:binky" {
+		t.Fatalf("tenant claim not bound to registration: %v", claims["tenant"])
+	}
+	verifyWithJWKS(t, h, token)
+}
+
+// A token minted for one registration never carries another registration's
+// tenant: this is the wrong-tenant evidence a resource server needs to reject
+// a caller by exact string comparison.
+func TestServiceTenantsAreDistinctPerRegistration(t *testing.T) {
+	h := serviceTokenHandler(t)
+	h.ClientConfig["platform-client"] = &domain.Client{
+		ClientID:       "platform-client",
+		AllowedScopes:  []string{"finance.qonto.read"},
+		GrantTypes:     []string{"client_credentials"},
+		ClientType:     "confidential",
+		ClientSecret:   "other-service-secret",
+		ServiceSubject: "service:platform-client",
+		Tenant:         "tenant:platform",
+		Roles:          []string{"platform"},
+	}
+	for clientID, want := range map[string]string{
+		"rapp-qonto":      "tenant:friendly:binky",
+		"platform-client": "tenant:platform",
+	} {
+		secret := "test-service-secret"
+		if clientID == "platform-client" {
+			secret = "other-service-secret"
+		}
+		req := tokenRequest(url.Values{"grant_type": {"client_credentials"}, "scope": {"finance.qonto.read"}})
+		req.SetBasicAuth(clientID, secret)
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, req)
+		if w.Code != http.StatusOK {
+			t.Fatalf("%s: status %d", clientID, w.Code)
+		}
+		token := decodeTokenResponse(t, w.Body.String())["access_token"].(string)
+		if got := parseJWTPayload(t, token)["tenant"]; got != want {
+			t.Fatalf("%s: tenant %v, want %v", clientID, got, want)
+		}
+	}
+}
+
+// A human token carries the directory tenant, defaulting to the platform tenant
+// (tenant:coulomb) rather than an empty claim.
+func TestHumanTenantClaimUsesDirectoryValueThenPlatformDefault(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		tenant string
+		want   string
+	}{
+		{"directory", "tenant:friendly:binky", "tenant:friendly:binky"},
+		{"default", "", "tenant:coulomb"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			user := aliceUser()
+			user.Tenant = tc.tenant
+			sessions := oidc.NewSessionStore()
+			h, _ := newTokenHandler(t, sessions, &mockUserRepo{users: map[string]*domain.User{"alice": user}})
+			verifier := "test-verifier"
+			code := seededSession(sessions, verifier)
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, tokenRequest(url.Values{"grant_type": {"authorization_code"}, "client_id": {"test-client"}, "code": {code}, "code_verifier": {verifier}}))
+			if w.Code != http.StatusOK {
+				t.Fatalf("status %d: %s", w.Code, w.Body.String())
+			}
+			access := decodeTokenResponse(t, w.Body.String())["access_token"].(string)
+			if got := parseJWTPayload(t, access)["tenant"]; got != tc.want {
+				t.Fatalf("tenant %v, want %v", got, tc.want)
+			}
+		})
+	}
+}