fix(access-requests): replace leaked <missing> placeholder with actionable field error

[juliahooper]

Summary

• Introduces RequiredFieldMissingError for access request items missing required fields (to_id, resource_id)
• Replaces three sites that raised domain exceptions with "<missing>" as a placeholder ID, leaking it into Problem Details responses
• Agents now get clear messages like "Required field 'to_id' is missing on the access request item; credential:bind requires a target toolkit"

Test plan

• Updated 3 existing unit tests to assert new exception type
• Verified no "<missing>" remains in error paths (grep clean)
• make test-fast passes (1929 tests, 78.64% coverage)
• ruff check + mypy clean