M1 acceptance gate: persisted client_credentials client gets a token (#25) - #113

No findings on this diff.

Reviewed both changed source files in full. app/sms-gateway/Cargo.toml adds only a [dev-dependencies] block whose eight entries all resolve to existing, correctly-versioned [workspace.dependencies] entries (base64, chrono, jsonwebtoken, rand, reqwest, rsa, serde, serde_json), inheriting the right features (jsonwebtoken's rust_crypto backend, reqwest's json+rustls-tls) with no dependency-tree forking, secrets, or CVE-relevant bumps. The new m1_acceptance_gate_live_postgres.rs is an #[ignore]d live-Postgres acceptance test whose RSA keys and hand-signed developer token are runtime-generated test-only stand-ins (not committed secrets); I verified the msisdn formatting, the SIGKILL/OS-process-restart seam, the missing-kid single-key JWKS path, scope echo, and the FORBIDDEN-with-permission-name denial — all correct. SAST reports no findings. No defects found; clean pass.