refactor: dispatcher as dumb pipe + add gRPC detection for Temporal

BREAKING CHANGE: Gateway no longer validates JWTs at dispatcher level.
Each upstream service (MinIO, Authentik, Temporal) validates bearer
tokens independently. Gateway passes Authorization header through unchanged.

Changes:
- Removed JWT validation from Dispatcher
- Removed internal/auth JWT validator usage
- Added gRPC URL scheme detection (grpc://)
- Added temporal-frontend with gRPC config (returns 501 not-implemented)
- All adapters now auth: required: false (services validate own tokens)
- Gateway is now a transparent routing layer, not auth gateway

gRPC forwarding requires grpcproxy middleware (future Phase 9).
For now, gRPC clients should connect directly to temporal-frontend:7233.

k8s/configmap.yaml

@@ -45,6 +45,7 @@ data:
         timeoutSeconds: 30
       auth:
         required: false
+        # Note: Services validate their own JWTs. Gateway is dumb pipe.
       resources:
       - name: send-message
         methods:
@@ -59,12 +60,25 @@ data:
         - verb: GET
           upstreamPath: /sqs/queues
 
-    # NOTE: temporal-frontend (port 7233) is gRPC-only, not HTTP.
-    # External worker/SDK access is unresolved per homelab/project-usage/jwt-auth-rollout.md
-    # Disabled until a gRPC-capable ingress is added.
-    # - serviceName: workflow
-    #   upstream:
-    #     url: http://temporal-frontend.temporal.svc.cluster.local:7233
+    - serviceName: workflow
+      upstream:
+        url: grpc://temporal-frontend.temporal.svc.cluster.local:7233
+        timeoutSeconds: 60
+      auth:
+        required: false
+      resources:
+      - name: execute
+        methods:
+        - verb: POST
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow
+      - name: describe
+        methods:
+        - verb: GET
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution
+      - name: list
+        methods:
+        - verb: GET
+          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions
 
     - serviceName: memory
       upstream:
@@ -92,6 +106,7 @@ data:
         timeoutSeconds: 30
       auth:
         required: false
+        # MinIO validates bearer tokens independently
       resources:
       - name: list-objects
         methods:
@@ -111,8 +126,8 @@ data:
         url: http://authentik-server.iam.svc.cluster.local:80
         timeoutSeconds: 30
       auth:
-        required: true
-        capability: "iam:admin"
+        required: false
+        # Authentik validates bearer tokens independently
       resources:
       - name: list-roles
         methods: