feat(audit): log successful JWT auth with subject, acting_party, roles (#21)

Add audit trail for authenticated API requests.

## Changes
- Add `auth ok` info log after JWT validation passes
- Export `ClaimString`/`ClaimStringSlice` from identity package
- Log fields: subject, acting_party, roles/permissions, path, method

## Log format
```json
{"level":"info","message":"auth ok","extra":{"subject":"2213aa...","acting_party":"portfolio-agent","roles":"llm:inference,memory:read","path":"/v1/chat/completions","method":"POST"}}
```

## Why
Gateway only logged auth failures — no audit trail for who accessed LLM endpoints. Required for cluster access auditing.

Complements existing X-Forwarded-User header injection (already complete).

---------

Co-authored-by: poimen <[email protected]>
Reviewed-on: #21

internal/proxy/proxy.go

@@ -359,6 +359,24 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		// Inject identity headers for downstream services
 		identity.Inject(r, claims)
 
+		// Audit trail: log successful JWT authentication
+		auditFields := map[string]string{
+			"path":   r.URL.Path,
+			"method": r.Method,
+		}
+		if sub := identity.ClaimString(claims, "sub"); sub != "" {
+			auditFields["subject"] = sub
+		}
+		if azp := identity.ClaimString(claims, "azp"); azp != "" {
+			auditFields["acting_party"] = azp
+		}
+		if roles := identity.ClaimStringSlice(claims, "roles"); len(roles) > 0 {
+			auditFields["roles"] = strings.Join(roles, ",")
+		} else if perms := identity.ClaimStringSlice(claims, "permissions"); len(perms) > 0 {
+			auditFields["permissions"] = strings.Join(perms, ",")
+		}
+		logging.Infof("auth ok", auditFields)
+
 		// Check required capability if configured
 		if h.config.Auth.RequiredCapability != "" {
 			if !h.jwtValidator.CheckPermissions(claims, h.config.Auth.RequiredCapability, "*") {