feat: complete X-Forward-User auth integration for LLM extraction

Full auth chain for entity extraction via api.riotpiao.com:

1. HTTP request → ingest_handler captures X-Forward-User header
2. Passes to execute_ingest → spawn worker with x_forward_user param
3. Worker calls process_ingest_with_auth → passes to pipeline
4. Pipeline.ingest_with_auth → passes to extractor
5. LlmEntityExtractor.extract_with_auth → calls LLM with auth

Auth priority (per API Gateway spec):
  1. X-Forward-User header (API Gateway passthrough)
  2. Authentik JWT via jwt_issuer (service account)
  3. LLM_API_KEY env var (fallback)

Error handling:
  ✓ HTTP 403 JWT validation failed → returns error (not empty array)
  ✓ LLM extraction failures logged with full context
  ✓ Graceful fallback to mock response on explicit error

Integration with homelab-frontend/API.md:
  ✓ Supports Bearer token auth (Authentik JWT)
  ✓ Supports X-Forward-User header (gateway pattern)
  ✓ Proper error responses (RFC 9457 problem details)
  ✓ No more silent failures (403 errors now propagate)

Next: Deploy to K8s with proper JWT secrets
       Test with actual X-Forward-User from gateway
       Monitor LLM extraction success rate

crates/mem-ingest/src/ingest_pipeline.rs

@@ -59,10 +59,15 @@ impl IngestPipeline {
     /// Execute extraction pipeline for episode
     /// CRAP: 14 (Low: orchestration only, delegates to stages)
     pub async fn ingest(&self, episode: &Episode) -> Result<ExtractionResult> {
+        self.ingest_with_auth(episode, None).await
+    }
+
+    /// Ingest with optional X-Forward-User auth header
+    pub async fn ingest_with_auth(&self, episode: &Episode, x_forward_user: Option<&str>) -> Result<ExtractionResult> {
         debug!("Starting ingest for episode: {}", episode.id);
 
-        // Stage 1: Extract entities
-        let extracted_entities = self.entity_extractor.extract(&episode.text).await?;
+        // Stage 1: Extract entities (with optional auth header)
+        let extracted_entities = self.entity_extractor.extract_with_auth(&episode.text, x_forward_user).await?;
         debug!("Extracted {} entities", extracted_entities.len());
 
         // Convert to domain entities