Implement KeyCape provider and service identity contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e3f-7301-7622-9be1-12e5f352881c

src/internal/server/oidc/token.go

@@ -232,11 +232,15 @@ func (h *TokenHandler) serveClientCredentials(w http.ResponseWriter, r *http.Req
 	}
 
 	now := time.Now()
+	tokenLifetime := h.TokenLifetime
+	if client.TokenLifetime > 0 {
+		tokenLifetime = client.TokenLifetime
+	}
 	claims := map[string]interface{}{
 		"iss":            h.Issuer,
 		"sub":            client.ServiceSubject,
 		"aud":            clientID,
-		"exp":            now.Add(h.TokenLifetime).Unix(),
+		"exp":            now.Add(tokenLifetime).Unix(),
 		"iat":            now.Unix(),
 		"tenant":         client.Tenant,
 		"principal_type": "service",
@@ -265,7 +269,7 @@ func (h *TokenHandler) serveClientCredentials(w http.ResponseWriter, r *http.Req
 	w.WriteHeader(http.StatusOK)
 	_ = json.NewEncoder(w).Encode(tokenResponse{
 		AccessToken: jwtToken, TokenType: "Bearer",
-		ExpiresIn: int(h.TokenLifetime.Seconds()),
+		ExpiresIn: int(tokenLifetime.Seconds()),
 	})
 }