feat(eims): take the source system from the access token

MoR stamps systemNumber and systemType into the access token it issues for
the authenticating credentials, which makes the token the authority on them.
Registration now reads both from there instead of from configuration, so the
SourceSystem block cannot drift from what the gateway believes we are.

EimsAuthService decodes the token payload after login, requires both claims
to be non-empty, and exposes them through getSessionContext(). The token is
decoded but never verified -- it is MoR's, signed with MoR's key -- and is
kept out of the log line, which names only the system it identified.

EIMS_SYSTEM_NUMBER and EIMS_SYSTEM_TYPE become optional expectations rather
than inputs: when set they are compared against the claims and a mismatch
fails fast, so neither side silently wins. Neither is required to register
any more.

Registration and manual resolution both resolve the session before touching
the state row, which is keyed by the system number: a login failure now
costs nothing because no counter has been reserved yet.

Test fixtures move to eims-test-fixtures.ts. They previously lived in
eims-auth.service.spec.ts, which made jest execute that suite again inside
every importing spec.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/edr-freight-api/.env.example

@@ -135,7 +135,9 @@ EIMS_CLIENT_ID=
 EIMS_CLIENT_SECRET=
 EIMS_API_KEY=
 EIMS_TIN=
-# MoR-issued source-system identifiers (used once invoice registration lands)
+# Source-system identity comes from the access token's systemNumber/systemType claims.
+# Setting these turns them into expected-value checks: a mismatch against the token fails
+# fast rather than one side silently winning. Leave empty to take the gateway's word.
 EIMS_SYSTEM_NUMBER=
 EIMS_SYSTEM_TYPE=
 # Absolute paths to the INSA-issued credentials. Keep them OUTSIDE the repo; the file