docs: add SAT developer guide and fix auth inaccuracies - Add Developer-Guide:-Service-Access-Tokens.md explaining the full PAT -> SAT exchange flow, stateless HS256 gate validation, 1-hour TTL, refresh strategy, and no-JWKS constraint - Fix refresh_token TTL in Developer-Guide:-Act-on-Behalf-of-a-User.md from 7200 seconds to 30 days (the correct value) - Add cross-reference from OAuth page to the new SAT guide explaining what getServiceAccessToken does - Fix stale osaas-api-docs link in Service:-Birme-Lambda.md to point to the new SAT guide - Add SAT guide reference to Developer-Guide:-Overview.md reference list

birme committed Jun 17, 2026