refactor(controlplane): make CAS source_internal resolution best-effort
Merged
MI
4mo ago+16+16+01234567890123456789-32-32-01234567890123456789
Summary
Follow-up to #3199.
Resolving whether a CAS credential should be flagged as internal platform traffic (source_internal) is now best-effort. The flag is set only when a system API token explicitly requests it. Any other caller requesting it is silently not flagged instead of being rejected with a Forbidden error.
This tolerates outdated systems whose token store does not yet mark their tokens as system: rather than failing the request, the credential is simply minted without the internal flag.
AI assistance
This change was developed with the assistance of Claude Code.
🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri