auth: enable JWT validation, support roles claim

- Enable auth in gateway config with JWKS URL
- Check both 'permissions' (users) and 'roles' (service accounts)
- Allow any Authentik issuer (service accounts have per-provider issuers)
- Required capability: llm:inference

k8s/configmap.yaml

@@ -11,8 +11,13 @@ data:
     # See REQUIREMENTS.md for full specification
     
     # JWT Authentication for /v1/* endpoints (LLM API)
+    # All Authentik providers share same signing key, so any JWKS URL works.
+    # Issuer varies per provider (portfolio-agent, memory-agent, local-llm, etc.)
+    # Gateway validates: signature + roles claim contains requiredCapability
     auth:
-      enabled: false
+      enabled: true
+      jwksUrl: "https://authentik.riotpiao.com/application/o/local-llm/jwks/"
+      requiredCapability: "llm:inference"
     
     # Routes: standard HTTP proxy routes (not LLM-specific)
     # These are for non-LLM services (agent-pod/console, etc.)