Align Soprano federated JWT with guided setup

[Hou (SciencePotato)]

Summary

Updated after merging guided setup (#16) from main. Resolves the conflict between the earlier optional API-key-plus-JWT implementation and the setup-configured OAuth path.

• Use one shared OAuth resolver per runtime, driven by EPP_PROVIDER_TENANT_ID, EPP_PROVIDER_SCOPE, EPP_OUTBOUND_CLIENT_ID and EPP_OUTBOUND_MI_CLIENT_ID.
• Preserve main's Bearer-only Soprano authentication, full selected endpoint URL, channel/auth-mode checks and separate Key Vault identity. No API-key fallback or duplicate legacy token acquisition.
• Retain JWT token-expiry checks, disabled configurable SDK transport retries, bounded acquisition and credential-log privacy in the single resolver.
• JavaScript and .NET share a 2.5-second cancellation signal/token across exchange stages. Python uses 2.5-second connect/read inactivity timeouts, not a total deadline.
• Adapt tests for setup names, one exchange, private logging, evaluation bypass, expired tokens, cancellation and no fallback/retry.
• Document migration from the older optional-JWT variables. This PR no longer exposes EPP_PROVIDER_JWT_ENABLED or the old provider-side client/MI aliases.

Scope

Setup scripts, provider profiles, all provider adapters and the local-settings sample are unchanged relative to main. The existing @azure/logger 1.3.0 dependency remains pinned for Node 20 compatibility. Local-settings-only PR #17 stays separate. No deployment, credential changes, new identities or live sends were performed for this resolution.

Validation

• JavaScript: 27 tests passed after a clean npm ci.
• Python: 34 tests passed.
• .NET: 53 tests passed; application build completed with zero warnings/errors.
• No conflict markers, unmerged index entries or editor errors; git diff --check passed.
• Remote CI must run on the new merge commit; approval remains required.

Live-verification limits

Historical QA4 API-key-plus-JWT successes do not validate this resolved revision. Separate prior Bearer-only shutter probes returned QA4 HTTP 201/FILTERED and production HTTP 401/error 401101. Neither proves production delivery or authorizes mapping FILTERED to success. Provider onboarding/authorization still requires confirmation.