[Feature]: Add TokenSmith-backed dynamic SMD authentication

[alexlovelltroy]

Describe the feature

Implement TokenSmith-backed service token exchange and integrate it into SMD client request auth,
with static JWT fallback retained.

Why do you want this feature?

Current branch only supports static SMD auth; feature/fabrica-0.3.0 includes dynamic token
exchange/refresh needed for service-to-service auth hygiene.

Scope

A) Service token manager

1. Add ServiceTokenManager with:
   • bootstrap token exchange
   • refresh-if-needed API
   • periodic background refresh
   • stats/introspection helpers
2. Add unit tests for:
   • successful bootstrap + refresh
   • retry/error behavior
   • endpoint-aware error surfacing

B) Server config and startup wiring

1. Add config/flags/env for:
   • tokensmith_url
   • tokensmith_bootstrap_token
   • tokensmith_target_service
   • tokensmith_scopes
   • tokensmith_refresh_skew_sec
2. Update SMD client initialization flow to:
   • use static JWT (SMD_JWT/SMD_TOKEN) when TokenSmith is not configured
   • initialize TokenSmith manager when configured
   • start background refresh loop with server context

C) HTTP client auth integration

1. Update SMD HTTP client to attach bearer token from service token manager on requests.
2. Preserve behavior when manager is absent (static token mode).

Acceptance Criteria

• Service starts in static mode without TokenSmith config.
• Service starts in TokenSmith mode with valid bootstrap token and refreshes token over time.
• Outbound SMD calls carry dynamic bearer token when TokenSmith mode is enabled.
• Unit tests cover manager lifecycle and auth header behavior.

Alternatives you've considered

I considered doing...

Additional context

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[synackd]

Is this integral to running metadata-service in the release repo where we need it merged before OpenCHAMI/release#50 gets merged, or can it be addressed after?

[davidallendj]

I think this was already completed since the linked PR already had the implemented dynamic auth with tokensmith.