feat(auth): validate access tokens with the ZITADEL Go SDK

Replace the handwritten Authentik JWT checks with github.com/zitadel/zitadel-go/v3.

What the SDK now owns:
- OIDC discovery (client.Discover) to find issuer and JWKS URI
- remote, auto-refreshing JWKS (rp.NewRemoteKeySet)
- signature, expiry and issuer checks (op.NewAccessTokenVerifier,
  op.VerifyAccessToken)
- the verified claim set and role lookup (oauth.IntrospectionContext,
  IsGrantedRole)

What stays local:
- a multi-audience allow-list, because this gateway is a shared resource
  server and the SDK's oauth.WithJWT accepts exactly one client ID
- an adapter from IntrospectionContext to jwt.MapClaims so the rest of the
  gateway keeps one claim representation

Other changes:
- issuer is configuration-driven; the hardcoded authentik.riotpiao.com
  check is gone
- aud may be a string or an array (ZITADEL sends an array)
- CheckPermissions also reads urn:zitadel:iam:org:project:roles, the claim
  ZITADEL uses for project roles
- requiredCapability accepts a comma-separated list, so llm:inference and
  llm-inference both satisfy the LLM gate
- a five-segment token is reported as an encrypted JWE with the fix in the
  message, instead of failing as a bad signature

Config: auth.zitadelDomain turns the SDK path on; jwksUrl stays supported for
the legacy path and for tests.

internal/config/loader.go

@@ -20,13 +20,16 @@ type rawConfig struct {
 
 // rawAuth represents auth configuration in YAML.
 type rawAuth struct {
-	Enabled            bool   `yaml:"enabled"`
-	Issuer             string `yaml:"issuer"`
-	Audience           string `yaml:"audience"`
-	JWKSURL            string `yaml:"jwksUrl"`
-	RequiredCapability string `yaml:"requiredCapability"`
-	TokenURL           string `yaml:"tokenUrl"`
-	ClientID           string `yaml:"clientId"`
+	Enabled             bool     `yaml:"enabled"`
+	Issuer              string   `yaml:"issuer"`
+	Audience            string   `yaml:"audience"`
+	JWKSURL             string   `yaml:"jwksUrl"`
+	RequiredCapability  string   `yaml:"requiredCapability"`
+	TokenURL            string   `yaml:"tokenUrl"`
+	ClientID            string   `yaml:"clientId"`
+	ZitadelDomain       string   `yaml:"zitadelDomain"`
+	ZitadelInsecurePort string   `yaml:"zitadelInsecurePort"`
+	ZitadelClientIDs    []string `yaml:"zitadelClientIds"`
 }
 
 // rawRoute represents a single route in the YAML configuration.
@@ -184,14 +187,17 @@ func LoadRoutesAndModelsFromFile(path string) (map[string]*Route, map[string]*Mo
 
 	// Parse auth config
 	authConfig := AuthConfig{
-		Enabled:            raw.Auth.Enabled,
-		Issuer:             raw.Auth.Issuer,
-		Audience:           raw.Auth.Audience,
-		JWKSURL:            raw.Auth.JWKSURL,
-		RequiredCapability: raw.Auth.RequiredCapability,
-		TokenURL:           raw.Auth.TokenURL,
-		ClientID:           raw.Auth.ClientID,
-		ClientSecret:       os.Getenv("AUTH_CLIENT_SECRET"),
+		Enabled:             raw.Auth.Enabled,
+		Issuer:              raw.Auth.Issuer,
+		Audience:            raw.Auth.Audience,
+		JWKSURL:             raw.Auth.JWKSURL,
+		RequiredCapability:  raw.Auth.RequiredCapability,
+		TokenURL:            raw.Auth.TokenURL,
+		ClientID:            raw.Auth.ClientID,
+		ClientSecret:        os.Getenv("AUTH_CLIENT_SECRET"),
+		ZitadelDomain:       raw.Auth.ZitadelDomain,
+		ZitadelInsecurePort: raw.Auth.ZitadelInsecurePort,
+		ZitadelClientIDs:    raw.Auth.ZitadelClientIDs,
 	}
 
 	return routes, models, adapters, authConfig, nil