feat(controlplane): allow system tokens to flag CAS credentials as internal
Adds an opt-in source_internal field to CASCredentialsServiceGetRequest so platform-side background processing can mark the CAS tokens it exchanges as internal traffic, suppressing CASArtifactUploaded/CASArtifactDownloaded audit events for it.
The flag is only honored when the caller authenticates with a system API token; any other caller requesting it is rejected with a forbidden error. User-token and regular API-token exchanges are unaffected and keep emitting transfer events. This implements the opt-in option from the linked issue, so sandbox and platform-generated uploads remain visible in transfer accounting unless explicitly flagged.
Closes #3198
AI disclosure: this contribution was produced with AI assistance (Claude Code).
🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri