Building a Federated Copilot: Part 2, Real PingFederate Token Exchange

Replace simulated exchanges with two TLS-protected PingFederate containers, pinned JWKS validation and private_key_jwt authentication.