Closes homelab#10 (P3.5) ## Endpoint `POST /auth/exchange` — RFC 8693-inspired token exchange. ## Flow 1. Validate `subject_token` (user JWT) via gateway's JWKS validator 2. Authenticate service via `client_credentials` against Authentik 3. Verify requested `scope` is subset of service's roles (deny escalation) 4. Return service token + subject identity metadata ## Request ```json {"subject_token": "<user JWT>", "client_id": "portfolio-agent", "client_secret": "<secret>", "scope": "memory:read", "resource": "poimen-memory"} ``` ## Response ```json {"access_token": "<service JWT>", "subject": "user-hash", "acting_party": "portfolio-agent", "scope": "memory:read"} ```
