feat(auth): validate access tokens with the ZITADEL Go SDK

Replace the handwritten Authentik JWT checks with github.com/zitadel/zitadel-go/v3.

What the SDK now owns:
- OIDC discovery (client.Discover) to find issuer and JWKS URI
- remote, auto-refreshing JWKS (rp.NewRemoteKeySet)
- signature, expiry and issuer checks (op.NewAccessTokenVerifier,
  op.VerifyAccessToken)
- the verified claim set and role lookup (oauth.IntrospectionContext,
  IsGrantedRole)

What stays local:
- a multi-audience allow-list, because this gateway is a shared resource
  server and the SDK's oauth.WithJWT accepts exactly one client ID
- an adapter from IntrospectionContext to jwt.MapClaims so the rest of the
  gateway keeps one claim representation

Other changes:
- issuer is configuration-driven; the hardcoded authentik.riotpiao.com
  check is gone
- aud may be a string or an array (ZITADEL sends an array)
- CheckPermissions also reads urn:zitadel:iam:org:project:roles, the claim
  ZITADEL uses for project roles
- requiredCapability accepts a comma-separated list, so llm:inference and
  llm-inference both satisfy the LLM gate
- a five-segment token is reported as an encrypted JWE with the fix in the
  message, instead of failing as a bad signature

Config: auth.zitadelDomain turns the SDK path on; jwksUrl stays supported for
the legacy path and for tests.

k8s/network-policy.yaml

@@ -99,19 +99,21 @@ spec:
     ports:
     - protocol: TCP
       port: 8080
-  # Allow to IAM (Authentik) for JWKS fetch + API
-  # Authentik pod listens on 9000 (http) and 9443 (https)
-  # Service translates 80→9000, 443→9443
-  # NetworkPolicy matches destination pod port, not service port
+  # Allow to IAM (Zitadel) for JWKS fetch + API
+  # Zitadel API listens on 8080 (h2c/plaintext in-cluster); the login UI
+  # listens on 3000. Public access goes through ingress-nginx on 443 (already
+  # covered by the 10.96.0.0/12 CIDR below), but 8080 keeps direct in-cluster
+  # calls working if CoreDNS rewrite is bypassed.
+  # NetworkPolicy matches destination pod port, not service port.
   - to:
     - namespaceSelector:
         matchLabels:
           kubernetes.io/metadata.name: iam
     ports:
     - protocol: TCP
-      port: 9000
+      port: 8080
     - protocol: TCP
-      port: 9443
+      port: 3000
   # Allow to SQS (queue management service)
   - to:
     - namespaceSelector: