fix: local sandbox bring-up — DC↔AS introspection alignment + TP atomMarshaller (#146)

[dfcoffin]

Surfaced by manually launching all three servers (AS + DC + TP) against a local MySQL (the "test all three servers" exercise). Two dev-bring-up blockers fixed; findings recorded.

1. DC↔AS opaque-token introspection (dev was broken)

DC defaulted to introspect at http://localhost:8080 with client datacustodian/datacustodian-secret — but the AS runs on :9999 and had no datacustodian client seeded → Connection refused → every token 401'd at the DC.

• AS: seed a dedicated datacustodian/{noop}datacustodian-secret introspection client (client_secret_basic) — a confidential client any of whose role is just to let the DC resource-server introspect; matches DC's default introspection client-id/secret so the sandbox works out of the box. Seeded-client assertion in MySqlTestcontainersIntegrationTest bumped 5→6.
• DC application-dev-mysql.yml: point issuer-uri + introspection-endpoint at the local AS :9999.
• Verified end-to-end: client_credentials token mint → /oauth2/introspect (active:true) → DC authorizes the request (reaches the controller). The subsequent 500 is a separate pre-existing bug — collection controllers marshal a raw List instead of an Atom <feed> — which the Remediation: ESPI REST controller modernization (post-#116) #119 E-phase entry/feed assembly fixes.

2. TP #146 — missing atomMarshaller bean

ResourceRESTRepositoryImpl requires a Jaxb2Marshaller @Qualifier("atomMarshaller") that didn't exist → TP APPLICATION FAILED TO START. Added JaxbMarshallingConfiguration defining it (scanning the shared common.domain/common.dto packages, same context the DC marshaller uses). TP now advances past this bean.

Full TP boot remains blocked on the deeper #146 chain — the next gap is the custom ResourceRepository interface, which has no implementation anywhere (the resource-fetch layer was never built). That's substantive TP work ("TP last") and out of scope here; documented on #146.

Bring-up status after this PR

• AS (9999) ✅ boots; token mint + introspection work.
• DC (8081) ✅ boots; introspection now succeeds against the AS.
• TP (8082) ⏳ advances past atomMarshaller; full boot tracked in TP bring-up: missing JAXB Atom marshaller, narrow component scan, and broader OAuth2-client wiring gaps #146.

No production behavior change (DC change is dev-profile only; AS adds one seeded client; TP adds a bean). TP has no @SpringBootTest context test (its integration test's @SpringBootTest is commented out), so the new bean has no test impact.

🤖 Generated with Claude Code