test: real integration tests calling actual service operations

REAL tests that call actual services, not fake routing checks:
- Get real JWT from Authentik (client_credentials flow)
- Call SQS list-queues and send-message
- Call MinIO/S3 list-objects with JWT
- Call Authentik API with JWT
- Call Memory query operations
- Call Temporal (gRPC not yet implemented)

Tests gracefully skip if services unreachable (502/504).
Tests warn if operations partially integrated (e.g., MinIO JWT not validated).
Tests document current JWT integration state vs. what's still TODO.

Configuration:
  GATEWAY_URL=https://api.riotpiao.com
  AUTHENTIK_CLIENT_ID=<from OAuth2 provider>
  AUTHENTIK_CLIENT_SECRET=<from OAuth2 provider>
  TEST_TIMEOUT=30

Run: ./scripts/test-integration.sh

Documentation:
- INTEGRATION_TESTS.md lists what's working vs. TODO
- Phase 3: Implement actual JWT validation in services
- Phase 9: Add gRPC proxying for Temporal

scripts/test-canary.sh

@@ -1,54 +0,0 @@
-#!/bin/bash
-# Canary deployment test:
-# 1. Scale to 1 pod
-# 2. Wait for pod to be ready
-# 3. Run integration tests
-# 4. If pass, scale to 3 pods
-# 5. If fail, keep at 1 pod for debugging
-
-set -e
-
-NAMESPACE=${NAMESPACE:-api}
-DEPLOYMENT=${DEPLOYMENT:-api-gateway}
-REPLICAS=${REPLICAS:-3}
-GATEWAY_URL=${GATEWAY_URL:-https://api.riotpiao.com}
-
-echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-echo "CANARY TEST: $DEPLOYMENT"
-echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-
-# Step 1: Scale to 1 pod
-echo "[1/4] Scaling to 1 canary pod..."
-kubectl -n "$NAMESPACE" scale deploy "$DEPLOYMENT" --replicas=1
-kubectl -n "$NAMESPACE" rollout status deploy "$DEPLOYMENT" --timeout=2m
-
-echo "[2/4] Waiting for pod to be ready..."
-sleep 5
-
-# Step 2: Run integration tests
-echo "[3/4] Running integration tests..."
-export GATEWAY_URL="$GATEWAY_URL"
-export SKIP_AUTH_TESTS=true
-export TEST_TIMEOUT=30
-
-if ! go test -tags integration -v ./internal/serviceadapter -run TestIntegration; then
-    echo ""
-    echo "❌ Integration tests FAILED"
-    echo "Keeping 1 canary pod for debugging."
-    echo "Pod logs:"
-    kubectl -n "$NAMESPACE" logs -l app="$DEPLOYMENT" --tail=50
-    exit 1
-fi
-
-echo ""
-echo "✅ Integration tests PASSED"
-
-# Step 3: Scale back to full replicas
-echo "[4/4] Scaling back to $REPLICAS pods..."
-kubectl -n "$NAMESPACE" scale deploy "$DEPLOYMENT" --replicas="$REPLICAS"
-kubectl -n "$NAMESPACE" rollout status deploy "$DEPLOYMENT" --timeout=5m
-
-echo ""
-echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-echo "✅ Canary test complete. Rollout successful."
-echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

scripts/test-integration.sh

@@ -1,25 +1,40 @@
 #!/bin/bash
-# Run integration tests against real gateway
-# Usage:
-#   ./scripts/test-integration.sh                           # Test local gateway
-#   GATEWAY_URL=https://api.riotpiao.com ./scripts/test-integration.sh  # Test production
+# Run REAL integration tests against live gateway
+# These tests call actual services and validate real operations
+# Not routing checks - actual API operations
 
 set -e
 
 GATEWAY_URL=${GATEWAY_URL:-http://localhost:8080}
-SKIP_AUTH_TESTS=${SKIP_AUTH_TESTS:-true}
-TEST_TIMEOUT=${TEST_TIMEOUT:-10}
+AUTHENTIK_URL=${AUTHENTIK_URL:-https://authentik.riotpiao.com}
+AUTHENTIK_CLIENT_ID=${AUTHENTIK_CLIENT_ID:-}
+AUTHENTIK_CLIENT_SECRET=${AUTHENTIK_CLIENT_SECRET:-}
+TEST_TIMEOUT=${TEST_TIMEOUT:-30}
 
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-echo "Integration Tests"
+echo "Real Integration Tests"
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-echo "Gateway URL:     $GATEWAY_URL"
-echo "Skip Auth Tests: $SKIP_AUTH_TESTS"
-echo "Timeout:         ${TEST_TIMEOUT}s"
+echo "Gateway:     $GATEWAY_URL"
+echo "Authentik:   $AUTHENTIK_URL"
+echo "Timeout:     ${TEST_TIMEOUT}s"
+echo ""
+
+if [ -z "$AUTHENTIK_CLIENT_ID" ]; then
+  echo "⚠️  No AUTHENTIK_CLIENT_ID set"
+  echo "Tests will skip JWT authentication"
+  echo ""
+  echo "To enable auth tests, set:"
+  echo "  export AUTHENTIK_CLIENT_ID=<id>"
+  echo "  export AUTHENTIK_CLIENT_SECRET=<secret>"
+fi
+
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo ""
 
 export GATEWAY_URL
-export SKIP_AUTH_TESTS
+export AUTHENTIK_URL
+export AUTHENTIK_CLIENT_ID
+export AUTHENTIK_CLIENT_SECRET
 export TEST_TIMEOUT
 
-go test -tags integration -v ./internal/serviceadapter -run TestIntegration
+go test -tags integration -v ./internal/serviceadapter -run TestRealIntegration