KEY-WP-0005-T01: IAM Profile core claims for the human PKCE flow

Verified first: grant_types_supported advertises client_credentials in
discovery.go, but token.go only ever accepted authorization_code -- no
service-token issuance path exists at all. Building one from scratch is
materially bigger than extending the existing flow; explicitly not
attempted here, left open in the workplan rather than declared done.

What shipped for the human Authorization Code + PKCE flow:

- domain.User.Tenant (new, omitempty) + token.go's effectiveTenant():
  falls back to tenant:coulomb (this workstation's actual tenant, ADR-0006)
  when unset -- never an empty tenant claim, never a silent reassignment.
- principal_type: "human", unconditional.
- groups/roles promoted from scope-gated to unconditional core claims,
  always [] not null when empty. One pre-existing test asserted the old
  scope-gated groups behavior -- updated to match the new intentional
  behavior, not left failing or reverted.
- assurance built from PKCESession.MFAVerified (new field, threaded
  through completeAuthorization's two call sites in authorize.go) --
  whether MFA was actually verified in this session, not static enrollment
  state. aal2 only when required-and-passed this time, aal1 otherwise.

go build/vet clean, go test ./... green repo-wide. Two new authorize_test.go
cases assert MFAVerified on both paths. tests/profile/profile_test.go's
TestCompleteTokenFlow (the repo's own full HTTP integration test) extended
with real value assertions for all five claims, not just presence checks.

Python conformance tool not run against a live instance (needs the full
Authelia+LLDAP+privacyIDEA stack); TestCompleteTokenFlow's real HTTP round
trip covers the equivalent claim checks instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/internal/server/oidc/token_test.go

@@ -81,13 +81,13 @@ func newTokenHandler(t *testing.T, sessions *oidc.SessionStore, users domain.Use
 	}
 	emitter := &captureEmitter{}
 	h := &oidc.TokenHandler{
-		ClientConfig: testClient(),
-		Sessions:     sessions,
-		Users:        users,
+		ClientConfig:  testClient(),
+		Sessions:      sessions,
+		Users:         users,
 		SigningKey:    key,
-		Issuer:       "https://auth.netkingdom.local",
+		Issuer:        "https://auth.netkingdom.local",
 		TokenLifetime: 15 * time.Minute,
-		Emitter:      emitter,
+		Emitter:       emitter,
 	}
 	return h, key
 }
@@ -377,9 +377,10 @@ func TestTokenHandler_ScopeFiltering_ProfileScope(t *testing.T) {
 	if _, ok := claims["email"]; ok {
 		t.Error("email must be absent when email scope is not granted")
 	}
-	// Without groups scope, groups must not be present.
-	if _, ok := claims["groups"]; ok {
-		t.Error("groups must be absent when groups scope is not granted")
+	// groups is a required IAM Profile core claim (iam-profile_v0.3.md) --
+	// present regardless of scope, unlike preferred_username/email above.
+	if _, ok := claims["groups"]; !ok {
+		t.Error("groups must be present as a core claim even without a groups scope (KEY-WP-0005-T01)")
 	}
 }
 
@@ -436,7 +437,7 @@ func TestTokenHandler_TokenIssuedTelemetry(t *testing.T) {
 		ClientConfig:  testClient(),
 		Sessions:      sessions,
 		Users:         users,
-		SigningKey:     key,
+		SigningKey:    key,
 		Issuer:        "https://auth.netkingdom.local",
 		TokenLifetime: 15 * time.Minute,
 		Emitter:       capture,