feat(proxy): add /auth/exchange token exchange endpoint

Closes homelab#10 (P3.5)

## Endpoint

`POST /auth/exchange` — RFC 8693-inspired token exchange.

## Flow

1. Validate `subject_token` (user JWT) via gateway's JWKS validator
2. Authenticate service via `client_credentials` against Authentik
3. Verify requested `scope` is subset of service's roles (deny escalation)
4. Return service token + subject identity metadata

## Request
```json
{"subject_token": "<user JWT>", "client_id": "portfolio-agent",
 "client_secret": "<secret>", "scope": "memory:read", "resource": "poimen-memory"}
```

## Response
```json
{"access_token": "<service JWT>", "subject": "user-hash",
 "acting_party": "portfolio-agent", "scope": "memory:read"}
```

internal/proxy/proxy.go

@@ -243,6 +243,10 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		h.handleAuthRefresh(w, r)
 		return
 	}
+	if r.URL.Path == "/auth/exchange" {
+		h.handleAuthExchange(w, r)
+		return
+	}
 
 	// Handle /v1/models endpoint (no routing needed, derived from config)
 	if r.URL.Path == "/v1/models" && r.Method == "GET" {