Persist resolved CIMD clients so Redis session rehydration finds them

[alex-feel]

Closes #6187

Problem

RedisStorage's session rehydration (unmarshalRequester) resolves the session's client through the bare storage's own GetClient row lookup — never through the CIMDStorageDecorator. A CIMD client is resolved dynamically at authorize time and never persisted, so at the token endpoint the lookup fails and every exchange for a CIMD client ends in a bare invalid_grant, with no server-side log line. Memory storage keeps the live client object, so only the CIMD × Redis combination breaks (see #6187 for the analysis and repro).

Change

Of the two directions proposed in the issue, this implements the persistence one, as laid out in #6187 (comment):

• On every successful CIMD document fetch, the decorator best-effort persists the resolved client into the underlying storage via RegisterClient (write-through; a persistence failure WARN-logs and does not fail the resolution).
• The persisted client is marked DCR-issued (registration.MarkDCRIssued gains a *LoopbackClient arm for the loopback-wrapped CIMD shape), so the row carries the same anti-bloat TTL as DCR registrations and RenewClientTTL keeps actively-used rows alive — unauthenticated /oauth/authorize traffic can mint these rows, so they must never be permanent.
• Rehydration reads the persisted snapshot without a document re-fetch, so established sessions also survive pod restarts (the decorator's LRU is per-instance memory) and document rotation mid-session.
• Diagnosability: unmarshalRequester now WARN-logs the client id and the wrapped error when the client lookup fails, so this failure mode is no longer silent server-side.

Tests

• Decorator: resolved clients (plain and loopback-wrapped) are persisted in the underlying storage and carry the DCR-issued marker; a failing RegisterClient does not fail resolution.
• Redis (miniredis): the full Redis storage rehydrates sessions past the CIMDStorageDecorator, so CIMD clients fail every token exchange with invalid_grant #6187 scenario — a CIMD-resolved client's authorize-code session rehydrates successfully with the document server shut down, and the persisted row carries a TTL. This test fails without the write-through and passes with it.

Note: #6283 touches other parts of the same decorator file; the two PRs are independent and either can land first.