feat(jans-shibboleth-idp): Shibboleth IDP Trust Relationship API

# Implement the Shibboleth IdP Trust Management REST APIs

The design is settled and the domain, adapters, DTOs, mappers, and OpenAPI contracts already exist and
are green. What remains is the **REST/transport layer**: serve the three APIs over HTTP, wired to the
existing public interfaces.

**The specification lives in the repo — read it there, not here.** This issue is intentionally thin so
it can't drift from the code; the documents are versioned alongside the contracts they describe:

- **[`README.md`](https://github.com/JanssenProject/jans/blob/issue_13590/jans-shibboleth-idp/docs/issues/README.md)**
— start here: why there are three APIs, the desired-vs-actual worker model, the trust-relationship
lifecycle, the conventions all three share (`snake_case`, `problem+json`, the `Result`/`DomainError`
contract), what already exists vs. what to build, and boot-time wiring.
- **[`trust-config-api.md`](https://github.com/JanssenProject/jans/blob/issue_13590/jans-shibboleth-idp/docs/issues/trust-config-api.md)**
— the user-facing desired-state API (`/v1/trust/config`).
- **[`trust-activation-api.md`](https://github.com/JanssenProject/jans/blob/issue_13590/jans-shibboleth-idp/docs/issues/trust-activation-api.md)**
— the worker/M2M reconciliation API (`/v1/trust/activation`).
- **[`file-staging-api.md`](https://github.com/JanssenProject/jans/blob/issue_13590/jans-shibboleth-idp/docs/issues/file-staging-api.md)**
— the out-of-band file byte-transfer service (`/v1/files`).

The wire contracts under **`openapi/`** and the Java public interfaces named in those docs are the
source of truth; where a doc and the code disagree, the code wins.

## Scope

- [ ] Serve every operation in all three `openapi/*.yaml` contracts.
- [ ] One central `Result`/`DomainError` → `problem+json` translator (per-API status/code tables in
the docs), covered by tests.
- [ ] Bearer/OAuth2 auth with the correct audience/scope per API.
- [ ] Boot wiring: single `PersistenceEntryManager`, repositories, `WorkOrchestrator`, the
`FinalizeActivationPort` bridge, and the `sweepExpiredLeases` scheduler.
- [ ] Contract + translator + env-gated HTTP integration tests pass; the offline build stays green.

> Note the one open item flagged in the file-staging doc: `FileStagingService.claim(...)` returns only
> a `Handle`, but the `ClaimResult` response needs the claimed `StagedFile` — decide whether to
> re-fetch in transport or extend the service.