Implement KeyCape provider and service identity contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c

src/internal/config/validate.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net/url"
 	"strings"
+	"time"
 )
 
 // ValidateConfig validates a loaded Config and returns a list of human-readable
@@ -56,6 +57,16 @@ func ValidateConfig(cfg *Config) []string {
 			if c.ServiceSubject == "" || c.Tenant == "" {
 				errs = append(errs, prefix+": client_credentials requires serviceSubject and tenant")
 			}
+			if c.TokenLifetime != "" {
+				lifetime, err := time.ParseDuration(c.TokenLifetime)
+				if err != nil {
+					errs = append(errs, prefix+": tokenLifetime must be a valid duration")
+				} else if lifetime < time.Minute || lifetime > time.Hour {
+					errs = append(errs, prefix+": tokenLifetime must be between 1m and 1h")
+				}
+			}
+		} else if c.TokenLifetime != "" {
+			errs = append(errs, prefix+": tokenLifetime is only supported for client_credentials clients")
 		}
 		// Warn about wildcard redirect URIs (they are blocked at runtime anyway).
 		for _, uri := range c.RedirectURIs {