Add WisdomAI MCP provider + Datadog identity fix + cross-provider PII

[yosrixp]

Summary

Adds the WisdomAI MCP provider end-to-end and folds in two adjacent fixes that surfaced during the integration: a Datadog /userinfo 401 caused by scope-gated identity API, and a doc-comment / test-data PII scrub across Datadog/Linear/Oracle-EPM.

1. WisdomAI (new provider)

• New OIDC tenant wisdomai: authorize at wisdom.ouryahoo.com, token at api.descope.com/oauth2/v1/apps/token (split-domain), jwks-path pinned at Descope's /well-known/jwks.json so Quarkus can verify the id_token RS256 signature without falling back to introspection.
• Synthetic GraphQL userinfo at /internal/wisdomai/oauth-userinfo that runs currentUser { id name email } and flattens to top-level OIDC claims.
• Confidential client via client_secret_post, with one-shot fallback to client_secret_basic on invalid_client. Secret stored in K8s under wisdomai-client-secret.
• Descope-specific error mapping: E061004 (azp mismatch), E061003 (RT revoked), E061002 (RT expired) → OktaTokenRevokedException so the L2 row is cleared and the user is force-redirected to re-login.
• L2-promoted with a 6-month upstream RT row TTL cap to bound Descope's ~10-year RT JWT.
• 7-day AT lifetime → uses 8-arg storeTokens so the bare L1 row outlives the global 8h server.token-store.expiry.
• Resource URI /v1/wisdomai/mcp across dev / stage / prod.

2. Datadog identity API fix

Datadog's /api/v2/current_user requires scopes that the MCP zero-scope AT does not carry — it returned 401 for every userinfo call. Fixed by:

• Switched DatadogUserInfoResource from /api/v2/current_user to /api/v2/users, which is filtered to a single row for the calling user under a zero-scope token.
• Accepts both data: [...] (list shape) and data: { ... } (defensive single-object) so a future Datadog response-shape change won't silently 502 us.
• Added diagnostics: on non-2xx upstream, logs the truncated Datadog error envelope (≤ 512 chars, no secrets) plus the last 8 chars of the bearer for log correlation.
• Updated env values to set datadog.scopes: [] (matches the actual zero-scope contract; the old mcp_read,mcp_write did nothing for /userinfo and was misleading).

3. Slack scope expansion + client_id rotation (stage only)

• Stage oidc.slack.clientId rotated to 223299515715.11244675106400.
• Added user scopes channels:write,im:write,mpim:write so Slack MCP can post to channels/IMs.

4. PII scrub

Replaced real Yahoo identities (yosrixp@yahooinc.com, real Linear/Datadog UUIDs) with synthetic placeholders (testuser@example.com, 00000000-0000-0000-0000-000000000001) in:

• Doc comments in DatadogUserInfoResource, LinearUserInfoResource, OracleEpmUserInfoResource.
• All WisdomAI tests (use alice@example.com / id 1234567890).
• The relevant lines in DatadogUserInfoResourceTest, LinearUserInfoResourceTest, OracleEpmUserInfoResourceTest, LinearResourceTest, DatadogResourceTest, OracleEpmResourceTest, UserInfoResourceTest, ZmsAssumeRoleResourceClientTest, ZmsResourceModelJsonTest, GrafanaManagementClientImplTest, UpstreamTokenConfigTest.

Files

• Java (new): WisdomAiResource, WisdomAiUserInfoResource, WisdomAiUpstreamRefreshClient, TokenExchangeServiceWisdomAiImpl
• Java (modified): DatadogUserInfoResource (identity API switch + diagnostics), LinearUserInfoResource + OracleEpmUserInfoResource (PII javadoc scrub), K8SSecretsProvider, TokenExchangeServiceProducer, UpstreamProviderClassifier, OauthProviderLabel
• Config: application.yaml, application.dev.yaml, configmap.yaml, default values.yaml, all three env overlays
• Tests: 4 new WisdomAI test classes + extended UpstreamProviderClassifierTest, TokenExchangeServiceProducerTest, UpstreamTokenConfigTest, K8SSecretsProviderTest, DatadogUserInfoResourceTest (new singleObjectDataShape defensive case) + PII scrub across the existing test suite

Operator prerequisites

Populate wisdomai-client-secret in the K8s secret store for stage and both prod regions before rollout — the OIDC tenant fails to start the code exchange without it.