refactor(security): add canonical Config construction path

## Parent

#425

## What to build

让 Security 可直接保留 canonical core Config，并通过根 Client 到 Security leaf 的完整请求证明配置传播。

## Acceptance criteria

- [ ] SecurityClient 可从 canonical core Config 构造
- [ ] 根 Client 使用新路径且 client.security leaf 可执行
- [ ] wiremock 证明 base URL、token provider 和 custom headers 传播
- [ ] 旧 SecurityConfig 路径暂时保持以支持 expand-contract

## Blocked by

None — can start immediately.
