Wire UpstreamTokenReader into vMCP incoming auth middleware

[jhrozek]

Summary

• The vMCP binary created an EmbeddedAuthServer but never extracted its
  UpstreamTokenReader to enrich Identity with upstream provider tokens.
  The JWT tsid claim was present but Identity.UpstreamTokens was always
  nil, causing the upstream_inject strategy to fail with "upstream token
  not found".
• Threads auth.TokenValidatorOption through NewIncomingAuthMiddleware and
  newOIDCAuthMiddleware to GetAuthenticationMiddleware. In commands.go,
  builds an InProcessService from the auth server's storage and refresher,
  and passes it as WithUpstreamTokenReader.

Part of #4141

Type of change

• Bug fix

Test plan

• Unit tests (task test)
• Linting (task lint-fix)

Changes

File	Change
cmd/vmcp/app/commands.go	Build InProcessService from auth server, pass as WithUpstreamTokenReader; fail fast if IDP token storage is nil
pkg/vmcp/auth/factory/incoming.go	Accept and thread TokenValidatorOption through middleware constructors

Special notes for reviewers

• Stacked on Add CRD type and converter for upstream_inject strategy #4391. Review only the top commit.
• Mirrors the proxy runner pattern at pkg/runner/runner.go:250-254 and pkg/auth/middleware.go:56.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 58.33333% with 20 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.52%. Comparing base (e3c605f) to head (7971fa9).
⚠️ Report is 25 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/vmcp/app/commands.go	0.00%	10 Missing ⚠️
pkg/vmcp/auth/factory/incoming.go	16.66%	3 Missing and 2 partials ⚠️
...perator/controllers/virtualmcpserver_deployment.go	0.00%	2 Missing ⚠️
...d/thv-operator/pkg/controllerutil/tokenexchange.go	0.00%	2 Missing ⚠️
...erator/api/v1alpha1/mcpexternalauthconfig_types.go	87.50%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4394      +/-   ##
==========================================
+ Coverage   69.48%   69.52%   +0.04%     
==========================================
  Files         486      487       +1     
  Lines       50017    50056      +39     
==========================================
+ Hits        34753    34802      +49     
+ Misses      12578    12576       -2     
+ Partials     2686     2678       -8     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

The base branch was changed.