INTEGRATION: Add Integration Tests For Sdk And AspNetCore Clients

[cjdutoit]

Third and final test tranche. Stacked on #27 (which is stacked on #26) — review those first; this retargets to main as they merge.

What this adds

23 integration tests (3 skipped, see below) exercising the real composed object graph — real brokers, real DI container, real configuration binding — rather than mocks.

NHSDigital.ApiPlatform.Sdk.Tests.Integration (19):

• CareIdentityServiceClientTests — login URL construction against the configured CIS2 endpoint, unique CSRF state per call, empty access token before login, logout without a session, and the validation/dependency-validation/cancellation paths.
• PersonalDemographicsServiceClientTests — configuration binding, null and unauthenticated search criteria, cancellation.
• ServiceCollectionExtensionsTests — the whole graph resolves from a real container and falls back to the in-memory storage brokers as singletons.

NHSDigital.ApiPlatform.Sdk.AspNetCore.Tests.Integration (4):

• The graph resolves through AddApiPlatformSdkCore + AddApiPlatformSdkAspNetCore, the session-backed brokers genuinely replace the in-memory defaults, and CSRF state and access tokens round-trip through ISession.

Three tests that need a live NHS conversation carry an explicit [Fact(Skip = "...")] rather than passing vacuously.

Replaces the previous NhsLoginTests

The old tests were removed and rewritten:

• Names (BuildLoginUrl, Logout, GetAccessToken, GetUserInfo) violated ts-testing-002 / ts-testing-007.
• Two of them asserted Assert.True(true, "..."), which cannot fail.
• The configuration binding was broken: configuration.GetSection("CIS").Get<ApiPlatformConfigurations>() bound nothing, because ApiPlatformConfigurations nests CareIdentity and PersonalDemographicsService while the JSON was flat. Every endpoint was therefore the empty string, and Assert.Contains(config.CareIdentity.AuthEndpoint, loginUrl) was asserting that the URL contains "". The appsettings shape is fixed and the endpoints are now genuinely asserted.

Please rotate these credentials

NHSDigital.ApiPlatform.Sdk.Tests.Integration/appsettings.json contained a live-looking CIS2 ClientId and ClientSecret committed to the repository. This PR removes them from the working tree and sources credentials from appsettings.Development.json (now git ignored) or ApiPlatform__CareIdentity__* environment variables — but they remain in git history, so they should be treated as compromised and rotated.

Closes #31

---

Review remediation

• ShouldOverrideTheInMemoryStorageBrokersWithSessionBackedOnes could not fail. It asserted the
  session brokers beat the in-memory ones without ever registering the in-memory ones, so the
  assertion was true by construction. It now registers both.
• Which uncovered a documentation bug. Adding the mirror test showed that registration order does
  not decide the winner, contrary to what Documentation/DependencyGraph/README.md claimed.
  AddApiPlatformSdkInMemoryStorage uses TryAddSingleton, but AddApiPlatformSdkAspNetCore uses
  plain AddScoped, which appends rather than no-ops — and the last registration for a service is
  the one that resolves. The session brokers therefore win in either order. The README advice to
  "call AddApiPlatformSdkAspNetCore() first or you get the process-wide singletons" was wrong, and
  both it and the graph descriptions are corrected. There is now a test for each ordering.
• ConfigurationProvider.HasCredentials was dead code and its XML doc described a
  skip-when-absent mechanism that does not exist. Removed, and the doc now says what actually
  happens: live tests carry an explicit [Fact(Skip = "...")].

Follow-up from the remediation verification pass

Documented one nuance the corrected registration-order claim did not cover: last-wins governs
GetService/GetRequiredService only. If AddApiPlatformSdkInMemoryStorage runs first, its
singleton descriptor remains in the collection, so GetServices<IApiPlatformStateBroker>() returns
both implementations and a host that enumerates them can still reach the process-wide singleton.