feat: add TTFT/ITL metrics for LLM inference

- RecordTTFT: Time-to-First-Token in milliseconds
- RecordITL: Inter-Token Latency in milliseconds
- RecordTokenCount: Track total tokens generated
- Prometheus exporter for /metrics endpoint
- Grafana dashboard ConfigMap (llm-metrics.json)
- ResponseWriterWrapper to capture metrics during LLM calls
- Metrics exported: llm_ttft_seconds, llm_itl_seconds, llm_tokens_total

API.md

@@ -571,42 +571,128 @@ curl -X GET https://api.riotpiao.com/ \
 
 ## Authentication
 
+All operations except `/healthz` and `/readyz` require JWT authentication.
+
 ### Bearer Token (JWT)
 
-All operations except `/healthz` and `/readyz` require authentication.
+Provide JWT in Authorization header:
 
 ```bash
 curl -H 'Authorization: Bearer <jwt-token>' \
   https://api.riotpiao.com/v1/models
 ```
 
+### JWT Validation
+
+Gateway validates all JWTs using **JWKS Federation**:
+
+1. **Fetch JWKS** — Gateway fetches public keys from Authentik's JWKS endpoint (refreshed every 15 minutes)
+2. **Verify Signature** — Validates JWT signature using public key matching `kid` header
+3. **Check Claims:**
+   - `iss` (issuer) — Must be Authentik provider (format: `https://authentik.riotpiao.com/application/o/{provider}/`)
+   - `exp` (expiration) — Token must not be expired (60s clock skew allowed)
+   - `nbf` (not before) — Token must not be in future (60s clock skew allowed)
+   - `aud` (audience) — Must be non-empty string from Authentik
+4. **Check Permissions** — Validates required capabilities from JWT claims (see RBAC section)
+
+**JWKS Endpoint:** `https://authentik.riotpiao.com/application/oidc/jwks/`
+
+**Multi-Issuer Support:** Gateway accepts JWT from any Authentik service account provider (paperless-ai-agent, portfolio-analyzer, etc) because all share the same JWKS signing key.
+
 ### Obtaining Tokens
 
-**Via Authentik OIDC (human login):**
+#### User Login (OIDC Device Code Flow)
+
 ```bash
 core auth login --username [email protected]
-```
+export USER_TOKEN=$(cat ~/.cache/talos/authentik_id_token)
 
-**Via service account (programmatic):**
-```bash
-core mwinit login --username service-account --password secret
-export RIOTPIAO_TOKEN=$(cat ~/.talos/.riotpiao-auth)
-
-curl -H "Authorization: Bearer $RIOTPIAO_TOKEN" \
+curl -H "Authorization: Bearer $USER_TOKEN" \
   https://api.riotpiao.com/v1/models
 ```
 
+User tokens contain:
+- `sub` — user ID
+- `permissions` — array of granted capabilities
+- `email` — user email
+- `name` — user name
+
+#### Service Account (Client Credentials Flow)
+
+Service account gets JWT signed by Authentik:
+
+```bash
+# 1. Authenticate service account with Authentik
+curl -X POST https://authentik.riotpiao.com/application/o/token/ \
+  -H 'Content-Type: application/x-www-form-urlencoded' \
+  -d 'grant_type=client_credentials' \
+  -d 'client_id=paperless-ai-agent' \
+  -d 'client_secret=<secret>' \
+  -d 'scope=openid'
+
+# Response:
+# {
+#   "access_token": "<jwt>",
+#   "token_type": "Bearer",
+#   "expires_in": 3600
+# }
+
+# 2. Use token for gateway calls
+export SERVICE_TOKEN=$(curl ... | jq -r .access_token)
+curl -H "Authorization: Bearer $SERVICE_TOKEN" \
+  https://api.riotpiao.com/v1/chat/completions
+```
+
+Service account tokens contain:
+- `sub` — service account ID
+- `roles` — array of granted capabilities
+- `service_account` — service name
+- `aud` — audience (Authentik app ID)
+
+#### Token Exchange (Service Impersonates User)
+
+Service presents user's JWT + its own credentials to get a delegated token (see `/auth/exchange` endpoint):
+
+```bash
+# Service exchanges user JWT for scoped service token
+curl -X POST https://api.riotpiao.com/auth/exchange \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "subject_token": "<user-jwt>",
+    "client_id": "paperless-ai-agent",
+    "client_secret": "<secret>",
+    "scope": "llm:inference memory:read"
+  }'
+
+# Response:
+# {
+#   "access_token": "<delegated-jwt>",
+#   "token_type": "Bearer",
+#   "expires_in": 3600,
+#   "subject": "<user-id>",
+#   "acting_party": "paperless-ai-agent"
+# }
+```
+
+Delegated tokens carry both user identity and service identity, enabling audit trails.
+
 ### Capabilities (RBAC)
 
-Tokens embed capabilities in claims. Required capabilities:
+JWT claims contain permission arrays. Required capabilities:
 
-- `llm:inference` — `/v1/*` chat/embeddings/rerank
-- `workflow:execute` — `/workflow` operations
-- `memory:read` — Memory queries
-- `memory:write` — Memory ingest
-- `sqs:access` — Queue operations
-- `s3:access` — S3 operations
-- `iam:admin` — IAM management
+| Capability | Used For |
+|------------|----------|
+| `llm:inference` | `/v1/chat/completions`, `/v1/embeddings`, `/v1/rerank` |
+| `workflow:execute` | `/workflow` (Temporal operations) |
+| `memory:read` | `/memory` query operations |
+| `memory:write` | `/memory` ingest operations |
+| `sqs:access` | `/sqs` queue operations |
+| `s3:access` | `/s3` object storage operations |
+| `iam:admin` | `/iam` user/group management |
+
+**Wildcard:** Token with `*` capability grants all permissions.
+
+**Permission Check:** JWT validated via `permissions` claim (user tokens) or `roles` claim (service account tokens).
 
 ---