Wire UpstreamTokenService and rewrite swap middleware

[jhrozek]

Summary

Connect the UpstreamTokenService to the middleware and simplify the swap logic.

What

• EmbeddedAuthServer constructs the service and exposes it via UpstreamTokenService() accessor
• MiddlewareRunner interface changes from GetUpstreamTokenStorage() to GetUpstreamTokenService()
• Middleware rewritten: replace direct storage access + manual expiry check with a single GetValidTokens() call + error-to-HTTP mapping

Why

Completes the upstream token refresh feature. The middleware becomes a thin layer that gets a valid credential or maps an error to the appropriate HTTP status.