MinIdp.Server controller assumes MinIdp security manager at the app level. This must be revised

We need to have an ability to run IDP server off another security manager which can be used to secure the IDP server itself. That security manager **may or may not BE THE SAME**.

Locate the MinIdp.Server controller and the app-level security-manager wiring first. Trace how the IDP server is secured, then determine the boundaries needed to support a separate security manager from the one used by the application. Done means the server can use either the same or a different security manager, with the expected behavior covered by the project’s existing tests.

Written by the indexing model from the issue text.