POST /auth/exchange: service presents user JWT + own credentials, gets scoped service token with subject identity metadata. Flow: validate subject token, authenticate service via client_credentials, verify scope subset, return token + metadata. Scope escalation denied if requested scope exceeds service roles. 14 tests covering: helpers, validation, missing fields, scope subset, JWT decoding, edge cases. Closes homelab#10 Co-authored-by: poimen <[email protected]>
