feat: setup phase 3 agent infrastructure + enable docker ci on prs

- Enable docker build, sha extraction on PRs (validate Dockerfile)
   - Add SOPS encrypted memory-agent credentials
   - Plan 15 tasks: 5 memory service + 10 temporal workflow
   - Milestone: monitoring-agent (due 2025-03-15)
   - Ready: Forgejo API token needed for PR automation
 ```

Co-authored-by: rock <[email protected]>

crates/mem-ingest/src/authentik_jwt.rs

@@ -0,0 +1,160 @@
+//! Authentik JWT Token Exchange
+//! 
+//! Uses OAuth2 client credentials flow to obtain JWT tokens from Authentik
+//! These tokens are used to authenticate with LLM gateway and S3
+
+use anyhow::{Result, anyhow};
+use serde::{Deserialize, Serialize};
+use std::sync::Arc;
+use std::sync::Mutex;
+use std::time::{SystemTime, Duration};
+
+/// JWT token response from Authentik
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct TokenResponse {
+    pub access_token: String,
+    pub token_type: String,
+    pub expires_in: u64,
+    #[serde(skip)]
+    pub obtained_at: Option<SystemTime>,
+}
+
+impl TokenResponse {
+    /// Check if token is still valid
+    pub fn is_expired(&self) -> bool {
+        match self.obtained_at {
+            Some(time) => {
+                let elapsed = time.elapsed().unwrap_or(Duration::from_secs(u64::MAX));
+                elapsed.as_secs() >= self.expires_in - 60  // Refresh 60s before expiry
+            }
+            None => true,  // No timestamp = expired
+        }
+    }
+}
+
+/// Authentik JWT issuer client
+pub struct AuthentikJwtIssuer {
+    issuer_url: String,
+    client_id: String,
+    client_secret: String,
+    cached_token: Arc<Mutex<Option<TokenResponse>>>,
+}
+
+impl AuthentikJwtIssuer {
+    pub fn new(issuer_url: &str, client_id: &str, client_secret: &str) -> Self {
+        Self {
+            issuer_url: issuer_url.to_string(),
+            client_id: client_id.to_string(),
+            client_secret: client_secret.to_string(),
+            cached_token: Arc::new(Mutex::new(None)),
+        }
+    }
+
+    /// From environment: AUTHENTIK_ISSUER, AUTHENTIK_CLIENT_ID, AUTHENTIK_CLIENT_SECRET
+    pub fn from_env() -> Result<Self> {
+        let issuer = std::env::var("AUTHENTIK_ISSUER")
+            .map_err(|_| anyhow!("AUTHENTIK_ISSUER not set"))?;
+        let client_id = std::env::var("AUTHENTIK_CLIENT_ID")
+            .map_err(|_| anyhow!("AUTHENTIK_CLIENT_ID not set"))?;
+        let client_secret = std::env::var("AUTHENTIK_CLIENT_SECRET")
+            .map_err(|_| anyhow!("AUTHENTIK_CLIENT_SECRET not set"))?;
+
+        Ok(Self::new(&issuer, &client_id, &client_secret))
+    }
+
+    /// Get valid access token, using cache if available
+    pub async fn get_access_token(&self) -> Result<String> {
+        // Check cache
+        if let Ok(lock) = self.cached_token.lock() {
+            if let Some(token) = lock.as_ref() {
+                if !token.is_expired() {
+                    tracing::debug!("Using cached Authentik token");
+                    return Ok(token.access_token.clone());
+                }
+            }
+        }
+
+        // Fetch new token
+        let mut token = self.fetch_token().await?;
+        token.obtained_at = Some(SystemTime::now());
+        let access_token = token.access_token.clone();
+        
+        // Cache it
+        if let Ok(mut lock) = self.cached_token.lock() {
+            *lock = Some(token);
+        }
+
+        Ok(access_token)
+    }
+
+    /// Exchange client credentials for JWT token
+    async fn fetch_token(&self) -> Result<TokenResponse> {
+        let client = reqwest::Client::new();
+        
+        // Authentik OAuth2 token endpoint
+        let token_url = format!("{}/token/", self.issuer_url.trim_end_matches('/'));
+        
+        let params = [
+            ("grant_type", "client_credentials"),
+            ("client_id", &self.client_id),
+            ("client_secret", &self.client_secret),
+        ];
+
+        let response = client
+            .post(&token_url)
+            .form(&params)
+            .timeout(Duration::from_secs(10))
+            .send()
+            .await?;
+
+        if !response.status().is_success() {
+            return Err(anyhow!(
+                "Authentik token request failed: {} - {}",
+                response.status(),
+                response.text().await.unwrap_or_default()
+            ));
+        }
+
+        let token_resp: TokenResponse = response.json().await?;
+
+        tracing::info!(
+            "Obtained Authentik JWT token (expires in {} seconds)",
+            token_resp.expires_in
+        );
+
+        Ok(token_resp)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_token_expiry_check() {
+        let mut token = TokenResponse {
+            access_token: "test".to_string(),
+            token_type: "Bearer".to_string(),
+            expires_in: 3600,
+            obtained_at: SystemTime::now(),
+        };
+
+        assert!(!token.is_expired());
+
+        // Simulate aged token
+        token.obtained_at = SystemTime::now() - Duration::from_secs(3600);
+        assert!(token.is_expired());
+    }
+
+    #[test]
+    fn test_issuer_creation() {
+        let issuer = AuthentikJwtIssuer::new(
+            "https://example.com",
+            "client_id",
+            "client_secret",
+        );
+
+        assert_eq!(issuer.issuer_url, "https://example.com");
+        assert_eq!(issuer.client_id, "client_id");
+    }
+}