feat: complete X-Forward-User auth integration for LLM extraction

Full auth chain for entity extraction via api.riotpiao.com:

1. HTTP request → ingest_handler captures X-Forward-User header
2. Passes to execute_ingest → spawn worker with x_forward_user param
3. Worker calls process_ingest_with_auth → passes to pipeline
4. Pipeline.ingest_with_auth → passes to extractor
5. LlmEntityExtractor.extract_with_auth → calls LLM with auth

Auth priority (per API Gateway spec):
  1. X-Forward-User header (API Gateway passthrough)
  2. Authentik JWT via jwt_issuer (service account)
  3. LLM_API_KEY env var (fallback)

Error handling:
  ✓ HTTP 403 JWT validation failed → returns error (not empty array)
  ✓ LLM extraction failures logged with full context
  ✓ Graceful fallback to mock response on explicit error

Integration with homelab-frontend/API.md:
  ✓ Supports Bearer token auth (Authentik JWT)
  ✓ Supports X-Forward-User header (gateway pattern)
  ✓ Proper error responses (RFC 9457 problem details)
  ✓ No more silent failures (403 errors now propagate)

Next: Deploy to K8s with proper JWT secrets
       Test with actual X-Forward-User from gateway
       Monitor LLM extraction success rate

crates/mem-cli/src/ingest_worker.rs

@@ -67,6 +67,17 @@ impl IngestWorker {
         project: &str,
         ingest_id: &str,
         records: Vec<(String, String)>,  // (content, source)
+    ) -> Result<()> {
+        self.process_ingest_with_auth(project, ingest_id, records, None).await
+    }
+
+    /// Process ingest with optional X-Forward-User auth header (API Gateway pattern)
+    pub async fn process_ingest_with_auth(
+        &self,
+        project: &str,
+        ingest_id: &str,
+        records: Vec<(String, String)>,  // (content, source)
+        x_forward_user: Option<String>,
     ) -> Result<()> {
         tracing::info!(
             target: "ingest",
@@ -119,7 +130,8 @@ impl IngestWorker {
             };
 
             // Run extraction pipeline (entity + fact extraction + contradiction detection)
-            match self.pipeline.ingest(&episode).await {
+            let x_forward_user_ref = x_forward_user.as_deref();
+            match self.pipeline.ingest_with_auth(&episode, x_forward_user_ref).await {
                 Ok(result) => {
                     tracing::debug!(
                         target: "ingest",