Adopt the v1 service account secret format

A secret is now ent_svc_<juri><account ULID><secret ULID>_<random><check>. Validate it fully offline before it is sent anywhere: 4 parts after the prefix, the jurisdiction pattern, uppercase ULIDs, a 52-character canonical lowercase base32 random part (no unused bits set), and the CRC-32/base62 checksum. Refuse each malformed shape without echoing the secret. The secret lives in its jurisdiction's regional database, so the exchange Core is https://<juri>.auth.entire.io unless ENTIRE_CORE_URL overrides it. The exchange, the identity cache key and ForgetServiceAccountSecretToken derive that origin in one place.

Tests use Core's published v1 vector (TestSecretFormatVector), cover every refusal, the per-jurisdiction Core, the override, and a 600-second token reused until 2 minutes before it expires.