API-GW OAuth
OAuth2 Token Exchange (RFC 8693), identity header injection, user-facing auth endpoints for api-gateway.
Dependency chain: P3.2 → P3.7 → P3.1 → P3.3 → P3.4 → P3.5 → P3.6 → P3.8 → P3.9
Issues tracked in rock/homelab-frontend.