ACCEPTANCE: Add Acceptance Tests For Sdk And AspNetCore Clients

[cjdutoit]

Second of three test tranches. Stacked on #26 — base is users/cjdutoit/foundations-sdk-add-unit-tests, so review that first and this will retarget to main once #26 merges.

What this adds

27 acceptance tests driving the public client surface end to end against a WireMock-stubbed CIS2 and PDS, with no mocks below the client boundary.

NHSDigital.ApiPlatform.Sdk.Tests.Acceptance — ApiPlatformClientTests (19), against the standalone ApiPlatformClient with in-memory storage:

• Full CIS2 login flow: build login URL → callback with the returned CSRF state → user info → access token → logout.
• PDS patient search by NHS number, asserting the Authorization, X-Request-ID and NHSD-Session-URID headers actually reach the wire.
• Validation paths: null criteria, empty criteria, searching before authenticating.
• Dependency paths: token endpoint and PDS endpoint returning 500 / 502 / 503 / 404.
• Cancellation paths: pre-cancelled token, and a token cancelled mid-flight against a deliberately slow PDS response — asserting OperationCanceledException surfaces unwrapped.

NHSDigital.ApiPlatform.Sdk.AspNetCore.Tests.Acceptance — SessionBackedApiPlatformClientTests (8), resolving the client from a DI container wired the way a host app would (AddApiPlatformSdkCore + AddApiPlatformSdkAspNetCore) with a session-backed IHttpContextAccessor:

• Asserts CSRF state, access token, refresh token and active role are written to and removed from ISession under the expected keys.
• Same login and patient-search flows, proving the session brokers substitute cleanly for the in-memory defaults.

Source changes

Two acceptance tests failed against the code as it stood and exposed real defects, fixed on the #26 branch:

1. CareIdentityService's outer TryCatch re-wrapped exceptions its own inner TryCatch had already mapped, so an HTTP 500 from the token endpoint reached callers as a dependency exception wrapping a service exception wrapping a dependency exception. It now rethrows its own exception types unchanged.
2. A CSRF state mismatch threw a raw InvalidOperationException, which the catch-all turned into a service exception — i.e. a caller-side tampering check reported as a server fault. It now throws InvalidStateCareIdentityServiceException and surfaces as a validation exception.

Integration tests follow in PR 3.

Closes #30

---

Review remediation

• 404 is no longer certified as a dependency failure. ShouldThrowDependencyExceptionOnSearchPatientsIfPdsFailsAsync
  ran NotFound through the same theory as 500 and locked in a mapping the repo's own exception
  rules contradict. 4xx now has its own test asserting *DependencyValidationException; the
  dependency-failure test covers 500/502 only.
• ShouldThrowValidationExceptionOnGetUserInfoIfStateDoesNotMatchAsync was misnamed — it asserts
  DependencyValidationException, a different category. Renamed.
• The acceptance suites no longer burn ~50s of dead wall clock. WireMock does not abandon a
  delayed response when the client aborts, and Stop() blocks on it, so each delay test billed its
  full delay. Delays are now just long enough to outlive the timeout under test. The SDK suite went
  from 30s to 2s; the ASP.NET Core suite from 20s to 7s.
• The 500 ms HttpClient timeout no longer applies to the whole class. It left roughly 35 ms of
  headroom over measured cold start, and did in fact produce a spurious failure during this work.
  The class container now uses the framework default, and only the two timeout tests build their own
  short-timeout container.

Follow-up from the remediation verification pass

• Added the missing end-to-end coverage for CIS 4xx -> CareIdentityServiceClientDependencyValidationException;
  only the PDS half of that mapping was covered.
• The timeout tests' arrange block was itself running under the 1 s timeout (~2x headroom, not 5x).
  Sign-in now goes through the default client and only the call under test uses the short-timeout
  container.
• WireMock delays trimmed again (5s -> 3s); the delay is paid in full at Stop(), so it is pure
  wall clock. The ASP.NET Core suite is now ~6s and the SDK suite ~2s, from 20s and 30s originally.
• NHS-number fixtures updated for the new 10-digit validation.