feat(a2a): migrate agent auth from XSUAA client-credentials to SAP IAS (#2593)

[jung-thomas]

Closes #2593.

Migrates the A2A agent (POST /a2a) authentication from the legacy XSUAA client-credentials flow to SAP IAS client-credentials (machine-to-machine), tenant atxgsg7zi. Mirrors the MCP signed-in tier migration (PR #2592). A2A is M2M (no browser), so this is a like-for-like swap of the token source (XSUAA → IAS) keeping the client-credentials grant — no PKCE/auth-code applies.

Non-breaking & reversible

CAP auth on the main srv is { kind: 'ias', xsuaa: true } (hybrid) under the [hybrid]/[production] profiles only — existing XSUAA tokens keep working through the transition. Unit tests stay on mocked auth (no base kind override). Rollback = revert the approuter route + card scheme; the hybrid kind can stay.

Changes

• Agent card advertises securitySchemes.ias (OAuth2 clientCredentials, scope openid); security: [{ ias: ['openid'] }]. XSUAA scheme removed.
• tokenUrl derived from the IAS issuer (<issuer>/oauth2/token), with ChatSettings.a2aTokenUrl as an optional DB override.
• Main srv gains the hybrid IAS auth kind; tutorials-identity (existing-service IAS client) bound to tutorials-srv in both MTA descriptors; XSUAA_MCP_URL wired onto tutorials-srv so the card advertises a non-empty tokenUrl on deployed envs.
• Approuter /a2a route authenticationType xsuaa → none (token-as-credential; CAP validates in-process). Same shape as the shipped /mcp-auth route.
• Docs (a2a-instructions.md, a2a-quickstart.md, api-docs/_index.md) + API inventory (api_endpoints.yaml, testing-endpoints.md) rewritten XSUAA → IAS; drift check passes (19 rows).

Spec: docs/superpowers/specs/2026-10-04-a2a-ias-auth-migration-design.md

Verification done

• Unit tests: test/unit/a2a/ 61 passed. Full suite run during impl: 0 auth-induced failures/skips (the hybrid kind un-skipped 1791 tests that a bare kind:ias would have skipped).
• Live IAS discovery on atxgsg7zi: token_endpoint = https://atxgsg7zi.accounts.ondemand.com/oauth2/token (exactly matches the derivation); client_credentials + client_secret_* supported.
• All files LF; drift OK.

⚠️ Reviewer gates before this reaches PROD

1. Central Joule / trusted-BTP coordination — the token source changes to IAS atxgsg7zi. The xsuaa:true hybrid keeps their current XSUAA tokens working, but they must re-point at the IAS token endpoint before the XSUAA fallback is removed (a later follow-up, not this PR). Do not remove the fallback until consumers confirm cutover.
2. Post-deploy smoke on DEV (deferred Task 5 — can't run from a feature branch):
   • Real IAS client-credentials token exchange succeeds for the A2A client on atxgsg7zi (no invalid_client).
   • Three /a2a outcomes: IAS bearer → 200; XSUAA bearer → 200 (hybrid); no bearer → 401 + WWW-Authenticate: Bearer + JSON-RPC -32001.
   • GET /.well-known/agent-card.json advertises a non-empty tokenUrl.

Out of scope: IAS mTLS/X509 (secretless), forwarded user-token/on-behalf-of, removing the XSUAA fallback.