Add AccountType to TokenInfo

- TokenInfo now includes AccountType ("human" or "system") from the
  MCIAS validate response
- Required for policy engines (MCR, Metacrypt) that match on account type
- Mock MCIAS in tests updated to return account_type
- New assertion in TestValidateToken verifies AccountType is populated

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

auth/auth.go

@@ -73,6 +73,11 @@ type TokenInfo struct {
 	// Username is the MCIAS username (the "sub" claim).
 	Username string
 
+	// AccountType is the MCIAS account type: "human" or "system".
+	// Used by policy engines that need to distinguish interactive users
+	// from service accounts.
+	AccountType string
+
 	// Roles is the set of MCIAS roles assigned to the account.
 	Roles []string
 
@@ -196,6 +201,7 @@ func (a *Authenticator) ValidateToken(token string) (*TokenInfo, error) {
 		Valid       bool     `json:"valid"`
 		Sub         string   `json:"sub"`
 		Username    string   `json:"username"`
+		AccountType string   `json:"account_type"`
 		Roles       []string `json:"roles"`
 	}
 	status, err := a.doJSON(http.MethodPost, "/v1/token/validate",
@@ -210,6 +216,7 @@ func (a *Authenticator) ValidateToken(token string) (*TokenInfo, error) {
 
 	info := &TokenInfo{
 		Username:    resp.Username,
+		AccountType: resp.AccountType,
 		Roles:       resp.Roles,
 		IsAdmin:     hasRole(resp.Roles, "admin"),
 	}

auth/auth_test.go

@@ -57,6 +57,7 @@ func mockMCIAS(t *testing.T) *httptest.Server {
 				"valid":        true,
 				"sub":          "uuid-admin",
 				"username":     "admin",
+				"account_type": "human",
 				"roles":        []string{"admin", "user"},
 			})
 		case "tok-user-456":
@@ -65,6 +66,7 @@ func mockMCIAS(t *testing.T) *httptest.Server {
 				"valid":        true,
 				"sub":          "uuid-user",
 				"username":     "alice",
+				"account_type": "human",
 				"roles":        []string{"user"},
 			})
 		case "tok-expired":
@@ -154,6 +156,9 @@ func TestValidateToken(t *testing.T) {
 	if info.Username != "admin" {
 		t.Fatalf("Username = %q, want %q", info.Username, "admin")
 	}
+	if info.AccountType != "human" {
+		t.Fatalf("AccountType = %q, want %q", info.AccountType, "human")
+	}
 	if !info.IsAdmin {
 		t.Fatal("IsAdmin = false, want true")
 	}