Accept MCIAS JWT tokens as passwords at token endpoint

The /v2/token endpoint now detects when the password looks like a JWT
(contains two dots) and validates it directly against MCIAS before
falling back to the standard username+password login flow. This enables
non-interactive registry auth for service accounts — podman login with
a pre-issued MCIAS token as the password.

Follows the personal-access-token pattern used by GHCR, GitLab, etc.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/server/routes.go

@@ -14,7 +14,7 @@ func NewRouter(validator TokenValidator, loginClient LoginClient, serviceName st
 
 	// Token endpoint is NOT behind RequireAuth — clients use Basic auth
 	// here to obtain a bearer token.
-	r.Get("/v2/token", TokenHandler(loginClient))
+	r.Get("/v2/token", TokenHandler(loginClient, validator))
 
 	// All other /v2 endpoints require a valid bearer token.
 	r.Route("/v2", func(v2 chi.Router) {