mark: Phase 8.2, 8.10 GREEN; create Phase 3 auth tasks

PHASE 8 COMPLETE (10/10 tasks):
- 8.2: X-Service/X-Resource dispatcher ✅
- 8.10: Phase gate - all 5 services routing ✅

Architecture decisions documented:
- Gateway = dumb pipe (Option B)
- SQS: gateway validates JWT (code unverified)
- MinIO, Temporal: native JWT support
- Memory, IAM: service-owned validation
- ConfigMap-based config with Stakater Reloader
- Real integration tests with cluster services

PHASE 3 (Auth) TASKS CREATED (0/3 TODO):
- 3.1: SQS JWT validation vs Authentik JWKS
- 3.2: MinIO native JWT load-test
- 3.3: Temporal JWT jwtKeyProvider configuration

Updates:
- tasks/8.2-x-service-dispatcher.md: marked GREEN
- tasks/8.10-serviceadapter-gate.md: marked GREEN with notes
- tasks/3.1-3.3: new Phase 3 auth tasks
- tasks/INDEX.md: Phase 8 complete, Phase 3 active

tasks/3.2-auth-minio-jwt-validation.md

@@ -0,0 +1,56 @@
+# 3.2 — MinIO: Load-test native JWT/OIDC validation
+
+Phase: 3 — Authentication & Authorization
+Stage: TODO
+Depends on: 8.2 (X-Service dispatcher), 8.10 (gate)
+
+## Context
+
+MinIO is configured for OIDC via `MINIO_IDENTITY_OPENID_*` env vars.
+Per homelab/project-usage/jwt-auth-rollout.md: "likely yes, **not yet load-tested**".
+
+**Phase 8.2 decision**: Gateway acts as dumb pipe, MinIO validates JWTs itself.
+
+## Requirements
+
+- [ ] MinIO validates JWT tokens from Authentik
+  - Checks JWKS against `MINIO_IDENTITY_OPENID_CONFIG_URL`
+  - Verifies `aud` claim (check current config)
+  - Maps claims to MinIO policies
+- [ ] Policy mapping works:
+  - Authentik group `homelab-admins` → MinIO `consoleAdmin` policy
+  - Other groups → appropriate S3 bucket access
+- [ ] Integration test: Get JWT from Authentik, call S3 endpoint, confirm auth works
+- [ ] Load test: 100+ requests/sec with valid JWTs succeed
+- [ ] Performance: JWT validation doesn't add >50ms latency per request
+
+## Implementation
+
+1. Verify MinIO OIDC config in k8s/infra (not this repo)
+2. Create JWT token with homelab-admins group
+3. Test S3 operations (ListBuckets, GetObject, PutObject)
+4. Add load test to integration suite
+
+## Verification
+
+```bash
+export JWT=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
+  -d "grant_type=client_credentials&client_id=<id>&client_secret=<secret>&scope=openid" \
+  | jq -r '.access_token')
+
+# List buckets
+aws s3 ls --endpoint-url https://api.riotpiao.com/ \
+  --header "Authorization: Bearer $JWT"
+
+# Get object
+curl -H "Authorization: Bearer $JWT" \
+  https://api.riotpiao.com/ \
+  -H 'X-Service: s3' -H 'X-Resource: list-objects'
+```
+
+## Notes
+
+- **Not Phase 8.2**: Phase 8 was routing, Phase 3 is auth verification
+- **MinIO owner responsibility**: Verify config in k8s/infra cluster
+- **Gateway responsibility**: Pass JWT through unchanged (dumb pipe)
+- **Test coverage**: Real JWT token, real S3 operations