feat(auth): add JWT-trust verification path with claims-derived identity

[jonpspri]

Wires the trust-eligible branch into get_current_user per the #5896 dispatch rule. A token marked token_use="trusted" with trust mode OFF is rejected 401 before the default funnel — the UUID heuristic could otherwise re-attribute identity. With trust mode ON, gateway-signed trust tokens authenticate via extract_trusted_principal: identity, teams, and roles come from the mapped claims; the external-group resolver translates group claims to CF team IDs (raw group IDs never reach token_teams); the configured revocation claim (jti default, uti supported) is checked against the revocation store on every request. The local user lookup, is_active, the UUID seam, and DB team resolution are skipped by design. The accepted posture change (no per-user is_active kill-switch in trust mode) is documented in code and configuration.md. Overage-marked tokens dispatch on jwt_trust_overage_policy. request.state mirrors the default-mode shape (token_teams, derived team_id, token_use="trusted", jti, auth_method).

Auth-cache Redis keys gain the mode segment (mcpgw:auth:{version}:{mode}:{key_type}:{identifier}) — a mode flip cold-starts all auth caches with no manual bump; the A.6 prefix test and doctest updated per plan.

All strict-xfail suites from #5896 (branch a), #5976, and #6272 flip green in this PR; exactly one xfail remains — the external-IdP branch (b) row pointing at #5903.

Tested with:

• uv run pytest tests -k "trust" -q — green; the only XFAIL is the External IdP trust root - claims-derived identity without provisioning #5903 row (grep accounting in the work order report)
• uv run pytest tests/unit/mcpgateway/test_auth_trust_mode.py -q — 9 passed, including the SQLAlchemy event-listener proof of ZERO email_users reads on the trust path
• make test — 23321 passed, 879 skipped, 3 xfailed (the External IdP trust root - claims-derived identity without provisioning #5903 row + 2 pre-existing plugin rows)
• make ruff — all checks passed
• Live-stack make test-mcp-rbac: implemented as tests/live_gateway/test_trust_mode_rbac.py (e2e + skip_no_gateway, verified skipping correctly — no live stack in this worktree); ON/OFF RBAC verified via the unit selection and the flipped matrix rows. The Epic 2 gate (Docs sweep + matrix error-path tests + Epic 2 validation gate #5906) runs the live stack in both modes.

Acceptance criteria of #5900 are met. Risk to existing users: none with trust mode off (default) — the branch is unreachable; default-mode paths byte-identical.

Stack: B.8 of epic #5885 (base: #6745).

Closes #5900

[jonpspri]

Requirement note (remediation) — context keys

The trust-path context now carries roles, token_is_admin, and token_teams from the principal. All authenticated paths carry the keys with neutral defaults.

Review caught one regression: the patch first dropped the token_use key. That key was restored with consumer-level regression tests (e18d043de).

The barrier test in this PR was re-pinned upstack (PR #6750). A valid Entra token with no seeded trust root keeps 401 (fall-through). See the notes on #5900.