Wire the token exchange handler into the fosite compose pipeline

[jhrozek]

Part of #5194.

Switches createProvider() from compose.Compose to NewAuthorizationServer with factory adapters, so the token exchange handler can be registered alongside the standard OAuth grant types.

• Adds a wrapComposeFactory adapter bridging compose.Factory -> server.Factory
• Registers tokenexchange.Factory in the extra-factories list
• Adds DelegationTokenLifespan to server config and run config (default 15m, max 24h)
• Advertises the token-exchange grant type in OAuth discovery metadata

Branch: token-delegation-2-fosite-wiring

[jhrozek]

Heads-up from the handler PR (#5822): the audience-hardening we just landed there adds a concrete requirement for this wiring.

The handler now validates the RFC 8707 resource parameter (and the sole-audience default fallback) against the client's registered audiences via fosite's audience strategy, not just the server-wide allowed-audiences list. fosite fails closed when a client's registered audience list is empty, so:

• Provision the confidential token-exchange client with a non-empty Audience covering every resource/default it will request. An agent client registered without an audience will have every exchange rejected with invalid_request — the handler works, but is inert until this is set. Note DCR can't create these clients (public-only, no token-exchange grant, never sets Audience), so the provisioning path is entirely on this issue.
• Add an end-to-end mint→exchange test as part of wiring. The handler is dormant today so its unit tests hand-craft tokens; a real mint→exchange path is what would catch a misconfigured client audience (and was the test gap flagged in the first review round).

Also confirm the 24h delegation-lifespan ceiling from #5194 is passed through here — the handler now rejects delegationLifespan > MaxAccessTokenLifespan at construction, so the compose wiring just needs to hand it a value in (0, 24h].

[jhrozek]

This was fixed in c1c9c45