feat(proxy): add /auth/token and /auth/refresh endpoints

POST /auth/token: exchanges username+password for JWT via upstream
identity provider (grant_type=password).
POST /auth/refresh: exchanges refresh_token for new JWT.

Both proxy to Authentik token endpoint using config from P3.7.
Upstream responses forwarded verbatim. No credentials logged or
leaked in responses. authClient interface extracted for testability.

15 tests covering: success, custom scope, missing fields, invalid
JSON, wrong method, not configured, upstream error, credential
rejection, token expiry, no credential leak.

Closes homelab#6
Closes homelab#8

Co-authored-by: poimen <[email protected]>

internal/proxy/proxy.go

@@ -29,6 +29,8 @@ type Handler struct {
 	config *config.Config
 	// jwtValidator validates JWT tokens for authenticated endpoints
 	jwtValidator *auth.Validator
+	// authHTTP is the HTTP client for token exchange with the identity provider.
+	authHTTP authClient
 	// Default timeouts for synthesized routes (model-based dispatch)
 	defaultConnectTimeout time.Duration
 	defaultReadTimeout    time.Duration
@@ -86,6 +88,10 @@ func New(cfg *config.Config) *Handler {
 		)
 	}
 
+	if cfg.Auth.TokenURL != "" {
+		h.authHTTP = newAuthClient()
+	}
+
 	for name, route := range cfg.Routes {
 		// Create a transport per unique upstream address for connection reuse
 		transport := h.getOrCreateTransport(route.Upstream.Address, &route.Upstream)
@@ -228,6 +234,16 @@ func writeProblemDetail(w http.ResponseWriter, status int, problemType, title, d
 
 // ServeHTTP implements http.Handler.
 func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// Auth endpoints — no JWT required (they issue tokens)
+	if r.URL.Path == "/auth/token" {
+		h.handleAuthToken(w, r)
+		return
+	}
+	if r.URL.Path == "/auth/refresh" {
+		h.handleAuthRefresh(w, r)
+		return
+	}
+
 	// Handle /v1/models endpoint (no routing needed, derived from config)
 	if r.URL.Path == "/v1/models" && r.Method == "GET" {
 		h.handleModelsEndpoint(w, r)