feat(oauth): add acr and auth_time to JWT access token and introspect

[StaberindeZA]

Because

• RFC 9470 section 5 requires the authorization server to include acr and auth_time on the access token, but the JWT access token builder emitted neither
• the ID token already carries both; the access token should match
• RFC 9470 section 6.2 adds acr and auth_time as top-level introspection members, but these values were unreachable — they lived only on the codes row, which is deleted at token exchange and never copied onto the access token

This pull request

• emits acr ("AAL" + aal) and auth_time on the JWT access token, mirroring the ID token, whenever the grant carries aal/authAt
• sources auth_time from grant.authAt directly, which is already in seconds (matching the token response auth_at) — no extra conversion
• persists authAt, amr, and aal on the Redis-backed access token (model constructor, toJSON, and parse; threaded through AccessToken.generate and generateAccessToken from the grant)
• returns acr ("AAL" + aal), auth_time (seconds, from authAt), and amr from /introspect for access tokens, and adds them to the Joi schema
• leaves refresh tokens untouched, so elevation does not survive a token refresh

Issue that this pull request solves

Closes: FXA-14309 / FXA-14310

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on:
• Suggested review order:
• Risky or complex parts:

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Any other information that is important to this pull request.