Optional access token validity parameter on session create and refresh (CDI 5.5)

Optional accessTokenValidity (ms) on POST /recipe/session and POST /recipe/session/refresh, CDI >= 5.5. The issued access token uses param ?? configured validity.

• Shorten-only: valid range 0 < param <= effective configured validity for the tenant; out-of-range is a 400, not a clamp.
• Applies to the access token minted by that call only; nothing is persisted; grace-window logic is unaffected.
• Jitter composes on the effective value.
• Refresh-token validity/expiry is not overridable.

Depends-on: #1301 Plan: PLAN-002