feat(auth): resolve service-principal group membership via Graph for app-only trust tokens

[jonpspri]

Adds app-only (client-credentials) trust-token group resolution to JWT-trust mode (issue #6756, epic #5885).

App-only Entra tokens carry idtyp="app", a roles claim, and no groups claim. Entra emits no overage markers for them, so the #5977 overage dispatch never triggers — and /users/{oid}/getMemberObjects would fail for a service principal (a service principal is not a user). Under jwt_trust_overage_policy="graph_lookup" this PR resolves the service principal's security groups through POST /servicePrincipals/{oid}/getMemberObjects and maps them through external_group_mappings.

Changes:

• detect_app_only_token(payload): True when idtyp == "app" (mcpgateway/utils/trusted_claims.py).
• EntraGraphClient endpoint selection: /servicePrincipals/{oid}/getMemberObjects for app-only tokens; /users/{oid}/getMemberObjects unchanged for user tokens. Client-credentials grant only; the inbound bearer token is never used. Same oid-keyed Redis cache, TTL bounded by exp.
• Trust-path dispatch (get_current_user): idtyp == "app" AND groups absent AND graph_lookup -> Graph resolve (cached) -> payload copy -> resolve_external_groups_to_teams. Under fail_closed (default) and proceed_without_groups an app token without groups authenticates with token_teams=[]; the app-role path (Admin claim feeds both admin tracks atomically + parity tests #5902) stays intact.
• make_trusted_test_jwt: new idtyp kwarg; default output unchanged.

TDD: 7 new tests in tests/unit/mcpgateway/test_entra_graph_client.py (red first: ImportError on the new symbols). URL capture asserts /servicePrincipals/{id} is called and /users/ never is for app tokens; fail_closed pins a roles=["viewer"] app token (authenticated, token_teams=[], viewer role granted); Graph failure under graph_lookup -> 401; Redis read error -> cache miss -> live call. All 11 pre-existing tests in the file pass unmodified (user-token overage regression).

Gate:

• make ruff — All checks passed!
• make test — 23411 passed, 879 skipped, 2 xfailed. (Two earlier full-suite runs each flaked on the pre-existing wall-clock benchmark test_trust_p99_within_2x_default under load; it passes in isolation and in the final green run. This PR adds no timing tests.)
• Pre-commit hooks on commit: ruff check/format, interrogate, bandit, IBM detect-secrets — all pass.

Note: the commit also carries the pre-staged .secrets.baseline regeneration (line-number bookkeeping for existing is_secret: false entries), which was already in the index from the stack work.

Risk to existing users: none — every new branch is trust-mode + graph_lookup gated; default mode and the user-token overage path verified green in the full suite.

Stack: B.15 of epic #5885 (base: #6755).

Closes #6756

---

External-IdP funnel parity (folded in)

build_trusted_external_identity now resolves app-only tokens' service-principal groups under jwt_trust_overage_policy=graph_lookup, mirroring get_current_user: when a token carries idtyp == "app", no groups claim, and no overage marker, the funnel queries /servicePrincipals/{oid}/getMemberObjects with the provider's client-credentials token (the inbound bearer is never used) and feeds the resolved IDs to the same external-group resolver. A Graph failure denies with metric reason service_principal_groups_unresolved (fail-closed). fail_closed and proceed_without_groups keep the previous behavior. Four deny-path/positive unit tests cover the dispatch in test_external_idp_trust_mode.py; use case 5 of the live Entra suite (#6931) proves it against a real tenant.

[jonpspri]

Requirement note (remediation) — validator wired

The group-existence validator is real now (5412c7719). Status semantics: 200 gives "valid"; 404 gives "graph_group_not_found" (row allowed, resolver fails closed at read); errors give "unknown" with a warning; non-Microsoft issuers get no call.

Also on this PR: a lazy import broke an import cycle that the remediation set introduced (aae0b9707), and the identity-domains doc row was refreshed. See the notes on #5977 and #5976.