feat(authbridge): make token-exchange plugin interface IDP-agnostic

[huang195]

Summary

AuthBridge's token-exchange today is RFC 8693 but carries Keycloak-specific assumptions. To support additional IdPs out of the box (Entra ID, Okta — tracked separately), Phase 1 is to nail down an IdP-agnostic plugin interface so each provider drops in as its own plugin via the existing registry, with no changes to the pipeline core.

Background

• Plugins self-register via RegisterPlugin(name, factory) and implement pipeline.Plugin — authbridge/authlib/plugins/registry.go.
• The current outbound exchanger lives in authbridge/authlib/plugins/tokenexchange/.
• Authoring contract: authbridge/docs/plugin-reference.md, tutorial authbridge/docs/plugin-tutorial.md.

Goals

• Audit tokenexchange/ for Keycloak-specific assumptions (token endpoint discovery, grant/parameter shapes, claim mapping, audience handling, error semantics).
• Define the provider-facing interface (or config contract) that an IdP plugin implements — what's common (RFC 8693 request/response) vs. provider-specific (endpoint resolution, scope/audience encoding, assertion type).
• Confirm the registry + config schema (SchemaProvider) can express per-IdP config without core changes; extend if not.
• Document the contract so Entra/Okta contributors can implement against it independently.
• Keep Keycloak as the reference implementation; no behavior change for existing deployments.

Non-goals

• Implementing Entra ID / Okta plugins (tracked in separate issues).

Notes

Collaborative design phase. Downstream config schema in kagenti/kagenti (charts/.../authbridge-template-configmaps.yaml, backend/.../test_authbridge_runtime_config.py) will need matching knobs once the interface is set.

[akram]

Note: #525 tracks the RFC 7523 cross-IdP federated token exchange flow (Keycloak JWT → Entra/Okta token). This is the next layer beyond the IdP-agnostic interface — the mechanism by which agents with Keycloak tokens can transparently obtain Entra/Okta tokens for external API access.

[huang195]

@akram can we close this one since #521 was merged? We can use #525 to track the remining work