feat(auth): bind stored credentials to authorization server issuer (SEP-2352)

Implements the authorization-server binding rule from SEP-2352: OAuth
credentials are now stamped with the issuer of the authorization server
that minted them, and get_access_token refuses to hand out a token when
the manager is configured against a different known issuer.

- Add StoredCredentials.issuer (Option<String>, #[serde(default)]) plus a
  with_issuer() builder; keep StoredCredentials::new() signature stable.
- Populate the issuer from AuthorizationMetadata at all token-persistence
  sites via a new AuthorizationManager::stored_credentials() helper
  (auth code, refresh, client-credentials, client-credentials-JWT, and
  OAuthState::set_credentials).
- Guard get_access_token() with check_issuer_binding(); on mismatch return
  the new AuthError::AuthorizationServerMismatch { stored, active }.
- Legacy credentials (issuer == None) and an unknown active issuer are
  treated as unbound and pass through, preserving backward compatibility.
- Add tests covering mismatch rejection, matching pass-through, legacy
  credentials, unknown active issuer, and issuer stamping.

Refs #879

Author: alexhancock