feat(auth): migrate CountryService to central token exchange

[natthapolvanasrivilai]

Summary

• replace CountryService's executable legacy IAM client with AuthService token exchange plus the central IAM client
• pin Maliev.Aspire.ServiceDefaults to 1.0.89-alpha for package-mode builds
• make the production Docker restore layer copy Directory.Build.props first and use package mode for restore/build/publish
• add regressions for exact process identity, fail-closed startup validation, exact bearer POST /iam/v1/auth/check-permission, legacy signer absence, unrelated HTTP-client isolation, endpoint metadata preservation, and Docker ordering

Validation

• focused auth boundary: 9/9
• non-integration: 169/169
• integration: 90/90
• full Release suite: 259/259
• normal Release build: 0 warnings, 0 errors
• package-mode Release build with published ServiceDefaults: 0 warnings, 0 errors
• scoped format verification: clean
• production Docker build: success (sha256:068b83355b0852c2675d815132133b4d464b46cb3f33e412eae9503e70a22ae3)
• independent security/correctness review: approved; POST assertion follow-up applied

Tracking: MALIEV-Co-Ltd/maliev-ops#91

No application was enabled, synced, merged, or deployed by this change.