feat: add auth mode none for testing (no auth required)

- Add AuthMode::None variant for disassembly/testing
- Returns synthetic JWT claims when auth disabled
- Set MEM_AUTH_MODE=none in config for dev/test
- Allows full API access without Authentik OIDC

crates/mem-cli/src/http_server.rs

@@ -50,13 +50,29 @@ pub struct AppState {
 pub enum AuthMode {
     Jwt,      // Validate JWT from Authentik
     ApiKey,   // Fallback to static API key
+    None,     // No auth (testing only)
 }
 
-/// Auth extractor — validates JWT or fallback to apikey
+/// Auth extractor — validates JWT, apikey, or disabled
 async fn validate_auth(req: &HttpRequest, state: &AppState) -> Result<(JwtClaims, String), HttpResponse> {
     match state.auth_mode {
         AuthMode::Jwt => validate_jwt_token(req, state).await,
         AuthMode::ApiKey => validate_apikey(req, state),
+        AuthMode::None => {
+            tracing::warn!("Auth disabled - returning synthetic claims");
+            let claims = JwtClaims {
+                sub: "test-user".to_string(),
+                iss: "test".to_string(),
+                aud: "memory".to_string(),
+                exp: i64::MAX,
+                iat: chrono::Utc::now().timestamp(),
+                nbf: None,
+                permissions: Some(vec!["memory:write".to_string(), "memory:read".to_string()]),
+                groups: Some(vec!["test".to_string()]),
+                roles: None,
+            };
+            Ok((claims, "synthetic-token".to_string()))
+        }
     }
 }
 
@@ -256,6 +272,7 @@ pub async fn start_server(port: u16, api_key: String, database_url: &str) -> Res
     let auth_mode = match auth_mode.as_str() {
         "jwt" => AuthMode::Jwt,
         "apikey" => AuthMode::ApiKey,
+        "none" => AuthMode::None,
         _ => {
             tracing::warn!("Unknown auth mode: {}, defaulting to apikey", auth_mode);
             AuthMode::ApiKey

k8s/app/config.yaml

@@ -10,7 +10,7 @@ metadata:
     app.kubernetes.io/component: config
 data:
   # Auth mode: jwt | apikey
-  MEM_AUTH_MODE: "jwt"
+  MEM_AUTH_MODE: "none"
   # Rate limiting
   MEM_RATE_LIMIT_INGEST: "100"
   MEM_RATE_LIMIT_QUERY: "1000"