fix(#160): correct AS↔DC token/introspection wire format to ESPI standard + pin contract (#150)

[dfcoffin]

Closes #160. Refs #150.

Problem (live bug, surfaced while scoping the #150 contract)

The C4 token-response/introspection augmentation diverged from the ESPI 4.0 standard (NAESB REQ.21 — its own example shows "resourceURI":".../resource/Batch/Subscription/{id}", "scope":"FB=...;...", only the three *URI fields, customerResourceURI may be "").

The producer emitted /resource/Subscription/{id} — missing /Batch/ — which DC's own ResourceValidationFilter already rejected (it expects /resource/Batch/Subscription). So a real customer token failed DC's resource validation. The AS also emitted three non-standard *_id claims (one mislabeled customer_subscription_id that was actually the retail-customer id).

Root-cause fix — one canonical builder/parser (no string patch)

The drift existed because producer and consumers each encoded the URL format independently.

• EspiBatchUri (openespi-common) — the single home for the ESPI Batch URL format: builds and parses Batch/{Subscription|Bulk|RetailCustomer}/{id} and Authorization/{id}. A test asserts the legacy /Subscription/{id} form does not parse as a Batch subscription.
• Producer (SubscriptionProvisioningServiceImpl) builds all three canonical URIs via EspiBatchUri — resourceURI→Batch/Subscription, authorizationURI→Authorization, customerResourceURI→Batch/RetailCustomer/{rc} (built from the retail-customer id DC holds, not the round-tripped handoff value).
• *_id claims dropped from the AS customizer + token-response handler; consumers parse ids from the canonical URIs. (Verified openespi-thirdparty doesn't read them.)

Contract pinned (#150) — lightweight, no Spring Cloud

These are standalone EC2 services, not a microservice mesh — so a shared-fixture consumer-driven contract, not Spring Cloud Contract:

• contracts/ holds the two ESPI-standard fixtures (Subscription + Bulk) as the single source of truth + a README.
• DC consumer test binds DC's parsing (EspiBatchUri + EspiScope) to the fixtures (asserts *_id absent, FB-grammar-only scope). Producer test asserts all three emitted URIs are canonical — so the contract is verified on both sides.

Verification

• common 18/18 · DC contract + controller 9/9 · AS testcontainers-it 20/20 (the PR D: Phase 2.0 integration test — auth-code flow + introspection + token-response augmentation end-to-end (closes #122 Step 6) #148 orchestration test confirms *_id gone + the URIs flow).
• DC and common run in CI; the AS changes are covered by the tagged testcontainers-it step.

Follow-ups (noted in the commit)

• Remove the now-vestigial customer_resource_uri from the back-channel request/handoff (structural cleanup).
• Empirically verify /oauth2/introspect surfaces the URI claims (note: DC enforces from its own stored Authorization.resourceURI, now the Batch form — the live path is fixed).

🤖 Generated with Claude Code