feat: exchange scoped approval service tokens per request

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

tests/test_service_auth.py

@@ -35,8 +35,8 @@ def _jwt(**overrides):
         "groups": [],
         "scope": "openbao:login",
         "assurance": {
-            "aal": "AAL1",
-            "method": "client_secret",
+            "level": "aal1",
+            "methods": ["client_secret"],
             "mfa": False,
             "source": "key-cape",
         },
@@ -91,7 +91,7 @@ class _Response:
     def __exit__(self, *_args):
         return False
 
-    def read(self):
+    def read(self, _size=-1):
         return json.dumps(self.payload).encode()