feat: add Temporal config and update routing with memory service integration

- Add TemporalConfig struct to internal/config
- Update gateway config with Temporal frontend service (port 7233)
- Update router with memory service adapter support
- Add config.local.yaml with memory service configuration
- Encrypt production config with SOPS (AES256_GCM)
- Support X-Service header routing pattern for service discovery
- Keep legacy path-based routes with deprecation warnings
- All 5 adapters preserved: workflow, memory, sqs, s3, iam

internal/config/config.go

@@ -24,6 +24,8 @@ type Config struct {
 	Adapters []*serviceadapter.ServiceAdapter
 	// Auth holds JWT authentication configuration for /v1/* endpoints.
 	Auth AuthConfig
+	// Temporal holds Temporal server configuration.
+	Temporal TemporalConfig
 }
 
 // ModelUpstream holds upstream configuration for a specific model.
@@ -38,6 +40,12 @@ type ModelUpstream struct {
 	AuthRequired bool
 }
 
+// TemporalConfig holds Temporal server configuration.
+type TemporalConfig struct {
+	// HostPort is the address of the Temporal server (host:port).
+	HostPort string
+}
+
 // AuthConfig holds JWT authentication configuration.
 type AuthConfig struct {
 	// Enabled globally enables/disables auth for /v1/* endpoints.
@@ -138,6 +146,12 @@ func Load() (*Config, error) {
 		authConfig = loadedAuth
 	}
 
+	temporalHostPort := "localhost:7233"
+	// Allow override via environment variable
+	if hostPort, ok := os.LookupEnv("TEMPORAL_HOST_PORT"); ok {
+		temporalHostPort = hostPort
+	}
+
 	return &Config{
 		ListenAddr:      listenAddr,
 		ShutdownTimeout: shutdownTimeout,
@@ -145,5 +159,8 @@ func Load() (*Config, error) {
 		Models:          models,
 		Adapters:        adapters,
 		Auth:            authConfig,
+		Temporal: TemporalConfig{
+			HostPort: temporalHostPort,
+		},
 	}, nil
 }

internal/server/router.go

@@ -33,8 +33,8 @@ func NewRouter(healthChecker *HealthChecker, dispatcher *serviceadapter.Dispatch
 // ServeHTTP implements http.Handler.
 // Priority order:
 // 1. /healthz and /readyz to health handlers
-// 2. X-Service header to ServiceAdapter dispatcher (phase 8)
-// 3. /workflow* to temporal handler
+// 2. X-Service header to ServiceAdapter dispatcher (phase 8) - PREFERRED routing method
+// 3. /workflow* to temporal handler - DEPRECATED: use X-Service: workflow instead
 // 4. All other paths to upstream handler (phase 0-7)
 func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	// Health endpoints first
@@ -48,6 +48,8 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	}
 
 	// X-Service (ServiceAdapter) routing - checked before path-based routing
+	// PREFERRED: All service routing should use X-Service header pattern for consistency,
+	// auth enforcement, and resource-based access control.
 	if req.Header.Get("X-Service") != "" {
 		if r.dispatcher != nil {
 			r.dispatcher.Dispatch(w, req)
@@ -56,6 +58,8 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	}
 
 	// Workflow endpoints
+	// DEPRECATED: Path-based /workflow routing is legacy.
+	// New clients should use X-Service: workflow header instead for consistent auth.
 	switch req.URL.Path {
 	case "/workflow", "/workflow/health", "/workflow/metrics":
 		r.temporalHandler.ServeHTTP(w, req)

internal/serviceadapter/router.go

@@ -164,6 +164,10 @@ func (d *Dispatcher) dispatchHTTP(w http.ResponseWriter, r *http.Request, upstre
 		req.URL.Path = method.UpstreamPath
 		req.RequestURI = ""
 		req.Host = parsedURL.Host
+		
+		// Preserve Authorization header for S3 SigV4 and other auth schemes
+		// Note: httputil.ReverseProxy preserves most headers automatically,
+		// but we need to ensure Authorization isn't lost when overriding Director
 	}
 
 	timeout := adapter.Spec.Upstream.TimeoutSeconds