fix: harden token cache, split compose, add saga idempotency and outbox cleanup

[falberthen]

Fixed

• Fixed thundering herd and missing TTL in TokenRequester: Adding a static SemaphoreSlim with double-check lock to prevent concurrent token refreshes hitting IdentityServer. Set AbsoluteExpiration on cache entry from JWT ValidTo - 60s. Guard ReadJwtToken against null AccessToken.
• Split infrastructure into docker-compose.infra.yml. by extracting postgres, kafka, connect, kafka-ui, pgadmin and aspire-dashboard into a dedicated infra file. Wire via include: so docker compose up still works with no flags.
• Added idempotency guard for RequestPayment and RequestShipment: Both handlers lacked a status check, allowing duplicate calls to external services on Kafka consumer retries. RequestPaymentHandler now skips if order is not Processed; RequestShipmentHandler skips if order is not Paid.
• Cleanup worker to purge old integration events in outbox. Added CreatedAt to IntegrationEvent for time-based queries. Register OutboxCleanupWorker as a BackgroundService that deletes entries older than 7 days every 24 h, preventing mt_doc_integrationevent from growing unboundedly since Debezium never removes rows it has forwarded.