ECS credentials endpoint returns static credentials instead of a task-role session #2601

GET /_fakecloud/ecs/creds/{task_id} (the ECS container credentials endpoint, crates/fakecloud-server/src/main.rs) returns static placeholder credentials (ASIAFFFF...) rather than credentials minted for the task's role.

#2562 fixed the same problem for Lambda: function containers now get a real STS session for the execution role (assumed-role/<role>/<function>), minted and registered like /_fakecloud/credentials so it verifies under --verify-sigv4 and is evaluated as that role under --iam. ECS tasks still don't, so code in a task container either can't authenticate under --verify-sigv4 or doesn't act as its task role under IAM enforcement.

Expected

• The endpoint returns credentials for the task definition's taskRoleArn (session name like AWS's, the task id), minted through the same issuer Lambda now uses (SessionCredentialIssuer / mint_session_credentials).
• Credentials are revoked when the task stops, and refreshed before expiry for long-running tasks (the ECS endpoint is polled by SDKs, so a fresh mint on refresh is fine).
• A task with no taskRoleArn gets an error response the SDKs handle, as on AWS.
• The same-account / trust-policy checks from feat(lambda): give function containers the AWS environment #2562 apply to taskRoleArn and executionRoleArn on RegisterTaskDefinition under IAM enforcement.