Closes homelab#6 (P3.1) and homelab#8 (P3.3) ## Endpoints | Path | Method | Body | What it does | |------|--------|------|-------------| | `/auth/token` | POST | `{username, password, scope?}` | Password grant → JWT | | `/auth/refresh` | POST | `{refresh_token, scope?}` | Refresh grant → new JWT | Both proxy to Authentik `tokenUrl` (from P3.7 config). Upstream response forwarded verbatim — client sees Authentik errors directly.
