Strip unused OIDC/JWK/JWT from auth-server (ESPI is opaque-only) #134

Summary

ESPI 4.0 uses opaque access tokens only, and the Sandbox Redesign constraint is that no JWK/JWT functions live in the ESPI token path (see #122 constraint comment). The auth-server currently carries OIDC + JWK/JWT machinery that the opaque flow never exercises. Strip it.

This is cleanup, not a bug fix — the server works today (opaque mint + introspection verified in #128). The goal is to remove unused, standard-violating surface so nobody builds on it.

Remove from openespi-authserver (AuthorizationServerConfig.java)

• jwkSource() bean + generateRsaKey() (RSA keypair, ~line 333, 385)
• jwtDecoder(...) bean (~line 349)
• .oidc(Customizer.withDefaults()) on the authorization-server configurer (~line 140)
• .oauth2ResourceServer(rs -> rs.jwt(...)) self-protection (~line 161, added in fix(authserver): canonical Spring Security 7.x filter chain + Jackson modules on custom repo #128)
• Related imports (com.nimbusds.jose.jwk.*, JwtDecoder)

CRITICAL — replace, don't just delete, the self-endpoint protection

Two dependencies make this more than a delete:

1. Removing .oidc() removes the OIDC endpoints /userinfo and /connect/register. Confirm nothing in the ESPI flow depends on them (the opaque flow doesn't). If dynamic client registration is wanted later, it must be done without OIDC/JWT.
2. .oauth2ResourceServer().jwt() currently protects the auth-server's own protected endpoints. fix(authserver): canonical Spring Security 7.x filter chain + Jackson modules on custom repo #128 set it to .jwt() specifically because Spring Security 7.x can't have both .jwt() and .opaqueToken() on one chain. If we simply delete it, those endpoints lose their resource-server protection. Replace with one of:
   • opaque self-introspection — the auth-server validates its own opaque tokens via .opaqueToken(...) pointed at its own /oauth2/introspect, or
   • Spring Security session/login protection for admin/registration endpoints (admins log in), or
   • remove the endpoints if unused.
     Decide per endpoint; don't leave them unprotected.

Also

• Delete the misleading comment in openespi-datacustodian/.../config/SecurityConfiguration.java:219 — "Future enhancement: Add JWT support for dynamic client registration scenarios" — it invites a non-compliant addition to the Resource Server.

Acceptance criteria

• No JWKSource/JwtDecoder/.oidc()/.jwt() in openespi-authserver production code
• Auth-server's own protected endpoints re-secured via a non-JWT mechanism (opaque self-introspection or session), or removed
• POST /oauth2/token (client_credentials) still returns a 200 opaque token; POST /oauth2/introspect still returns the RFC 7662 response (the fix(authserver): canonical Spring Security 7.x filter chain + Jackson modules on custom repo #128-verified flow unbroken)
• DataCustodian SecurityConfiguration.java:219 "add JWT" comment removed
• Boots clean on dev-mysql

Related

• #122 Phase 2.0 (constraint comment)
• #128 added the .jwt() self-protection being revisited here
• #112 auth-server role