[Client] Test cross-app access against a real identity provider #720

Cross-app access from #669 has only been tested against the auth/enterprise-managed-authorization conformance scenario so far. The mock checks the shape of our requests, but not that a real identity provider accepts them, and it is much less strict about the token exchange than a real one would be. Keycloak, which our E2E suite uses, can't issue ID-JAGs.

Once a provider supports it (Okta's Cross App Access looks like the first candidate), let's run the whole chain against it:

• ID token => ID-JAG at the identity provider, with the right audience, resource and client credentials
• ID-JAG => access token at the MCP authorization server, with the issuer pinned
• an ID token that has expired or was issued for someone else gets refused

If it holds, we add it to tests/E2E where possible and drop the experimental note in docs/client/authorization.md.