rock
359645f397
CI / CI (push) Successful in 3m22s
Closes homelab#10 (P3.5)
## Endpoint
`POST /auth/exchange` — RFC 8693-inspired token exchange.
## Flow
1. Validate `subject_token` (user JWT) via gateway's JWKS validator
2. Authenticate service via `client_credentials` against Authentik
3. Verify requested `scope` is subset of service's roles (deny escalation)
4. Return service token + subject identity metadata
## Request
```json
{"subject_token": "<user JWT>", "client_id": "portfolio-agent",
"client_secret": "<secret>", "scope": "memory:read", "resource": "poimen-memory"}
```
## Response
```json
{"access_token": "<service JWT>", "subject": "user-hash",
"acting_party": "portfolio-agent", "scope": "memory:read"}
```