Introspect Endpoint

RFC 7662 token introspection.

The hosted MCP gateway calls this to validate a caller's bearer token: we sign tokens HS256 (symmetric), so there is no JWKS for the gateway to verify against — it asks us instead. The gateway authenticates as a confidential client (client_secret_basic); we then decode the token and return its claims.

Per RFC 7662 an inactive/invalid token is a normal 200 {"active": false} — only a CALLER authentication failure is a non-200 (401), and an unconfigured env is 503.