feat(eims): take the source system from the access token

MoR stamps systemNumber and systemType into the access token it issues for
the authenticating credentials, which makes the token the authority on them.
Registration now reads both from there instead of from configuration, so the
SourceSystem block cannot drift from what the gateway believes we are.

EimsAuthService decodes the token payload after login, requires both claims
to be non-empty, and exposes them through getSessionContext(). The token is
decoded but never verified -- it is MoR's, signed with MoR's key -- and is
kept out of the log line, which names only the system it identified.

EIMS_SYSTEM_NUMBER and EIMS_SYSTEM_TYPE become optional expectations rather
than inputs: when set they are compared against the claims and a mismatch
fails fast, so neither side silently wins. Neither is required to register
any more.

Registration and manual resolution both resolve the session before touching
the state row, which is keyed by the system number: a login failure now
costs nothing because no counter has been reserved yet.

Test fixtures move to eims-test-fixtures.ts. They previously lived in
eims-auth.service.spec.ts, which made jest execute that suite again inside
every importing spec.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/edr-freight-api/src/config/eims.config.ts

@@ -16,7 +16,14 @@ export interface EimsConfig {
   clientSecret: string;
   apiKey: string;
   tin: string;
-  /** MoR-issued source-system identifiers; unused until invoice registration lands. */
+  /**
+   * Optional *expectations* for the source-system identity, not inputs.
+   *
+   * The access token MoR issues carries `systemNumber` and `systemType` claims for the credentials
+   * that authenticated, and those are what registration uses. When these are set they are compared
+   * against the token and a mismatch fails fast — neither side silently wins. Leave them empty to
+   * take whatever the gateway says.
+   */
   systemNumber: string;
   systemType: string;
   /** Filesystem path to the INSA-issued RSA private key (PEM). Never leaves the server. */