feat: bundle XTM One in the default stack

[azubiolo-filigran]

Testing: OpenAEV + XTM One Docker Setup

Steps to reproduce

# 1. Clone repos side-by-side
git clone git@github.com:OpenAEV-Platform/docker.git openaev-docker
git clone git@github.com:XTM-One-Platform/xtm-one.git xtm-one
cd openaev-docker
git checkout feat/xtm-one-default

# 2. Create .env from sample
cp .env.sample .env
sed -i "s/OPENAEV_ADMIN_TOKEN=00000000-0000-0000-0000-000000000000/OPENAEV_ADMIN_TOKEN=$(uuidgen)/" .env
sed -i "s/XTM_ONE_SECRET_KEY=ChangeMeWithGeneratedRandomString/XTM_ONE_SECRET_KEY=$(openssl rand -hex 32)/" .env

# 3. Build and start
docker compose up -d --build

# 4. Wait (~2-3 min) then verify
docker compose ps  # all services healthy

Note: The compose file has build: context: ../xtm-one directives for xtm-one and xtm-one-worker services. This requires the xtm-one repo cloned adjacent to this repo. Alternatively, remove the build: blocks and pull a pre-built image.

Credentials

Service	URL	Email	Password
OpenAEV	http://localhost:8080	admin@openaev.io	changeme
XTM One	http://localhost:4000	admin@openaev.io	changeme

Key fixes in this commit

1. OPENAEV_BASE-URL=http://openaev:8080 — JWT audience validation must match the internal hostname
2. BASE_URL=http://xtm-one:4000 — JWT issuer + JWKS fetch must use internal hostname
3. XTM_ONE_ADMIN_EMAIL=admin@openaev.io — must match OpenAEV admin so JWT email resolves
4. Build directives — build: context: ../xtm-one for local builds without registry access

Dependency

Requires XTM-One-Platform/xtm-one#1070 (fix/platform-registration-api-url-override) — adds OPENAEV_API_URL env var support so the registration stores the internal Docker URL instead of the platform-reported external URL.

Status

• ⚠️ OpenAEV JVM did not fully start during testing (stuck after banner, no Spring Boot logs after 3+ min). Likely a resource/config issue unrelated to XTM One integration. The XTM One side starts correctly.
• The JWT auth fix pattern is identical to what was verified working on the OpenCTI docker stack.

[gregoirelafay]

tested locally, LGTM