mark: Phase 8.2, 8.10 GREEN; create Phase 3 auth tasks

PHASE 8 COMPLETE (10/10 tasks):
- 8.2: X-Service/X-Resource dispatcher ✅
- 8.10: Phase gate - all 5 services routing ✅

Architecture decisions documented:
- Gateway = dumb pipe (Option B)
- SQS: gateway validates JWT (code unverified)
- MinIO, Temporal: native JWT support
- Memory, IAM: service-owned validation
- ConfigMap-based config with Stakater Reloader
- Real integration tests with cluster services

PHASE 3 (Auth) TASKS CREATED (0/3 TODO):
- 3.1: SQS JWT validation vs Authentik JWKS
- 3.2: MinIO native JWT load-test
- 3.3: Temporal JWT jwtKeyProvider configuration

Updates:
- tasks/8.2-x-service-dispatcher.md: marked GREEN
- tasks/8.10-serviceadapter-gate.md: marked GREEN with notes
- tasks/3.1-3.3: new Phase 3 auth tasks
- tasks/INDEX.md: Phase 8 complete, Phase 3 active

tasks/3.3-auth-temporal-jwt-validation.md

@@ -0,0 +1,65 @@
+# 3.3 — Temporal: Configure native JWT validation via jwtKeyProvider
+
+Phase: 3 — Authentication & Authorization
+Stage: TODO
+Depends on: 8.2 (X-Service dispatcher), 8.10 (gate)
+
+## Context
+
+Temporal Helm chart supports native JWT authorization:
+- `server.config.authorization.jwtKeyProvider` 
+- `claimMapper` for custom claim handling
+
+Per homelab/project-usage/jwt-auth-rollout.md: "native JWT authorization support".
+But currently **not configured** — unresolved design question on external access.
+
+**Phase 8.2 decision**: Gateway detects gRPC (returns 501 not-implemented).
+Phase 9 will add gRPC proxy. Phase 3 can configure JWT validation in Temporal.
+
+## Requirements
+
+- [ ] Configure `server.config.authorization.jwtKeyProvider` in Temporal Helm values
+  - Point at Authentik JWKS: `https://authentik.riotpiao.com/application/o/workflow/jwks/`
+- [ ] Configure `claimMapper` to translate Authentik claims:
+  - `permissions` claim → Temporal permissions
+  - OR `groups` claim → Temporal role mappings
+- [ ] Test: In-cluster worker with JWT can connect to Temporal frontend
+- [ ] Test: Unauthenticated client gets 401
+- [ ] Verify: No impact on existing workers/clients (backward compat)
+
+## Implementation
+
+1. Update k8s/infra temporal-values.yaml:
+   ```yaml
+   server:
+     config:
+       authorization:
+         jwtKeyProvider:
+           keySourceURIs:
+             - "https://authentik.riotpiao.com/application/o/workflow/jwks/"
+         claimMapper: |
+           # Custom claims mapping (TBD)
+   ```
+2. Deploy & test
+3. Add integration test (requires gRPC client, Phase 9)
+
+## Verification
+
+```bash
+# In-cluster test (Pod with JWT)
+kubectl -n temporal run --rm -it temporal-test \
+  --image=temporalioservices/temporal-server:latest \
+  -- tctl --address temporal-frontend:7233 namespace list
+
+# External test (Phase 9, requires gRPC proxy)
+# grpcurl -H "Authorization: Bearer $JWT" \
+#   temporal-frontend.cluster.local:7233 \
+#   temporal.api.workflowservice.v1.WorkflowService/ListNamespaces
+```
+
+## Notes
+
+- **Not Phase 8.2**: Routing is done, auth config is Phase 3+
+- **Temporal owner responsibility**: Configure JWT in temporal-values.yaml (k8s/infra)
+- **Gateway responsibility**: Pass gRPC through (Phase 9: grpcproxy)
+- **Open question**: External access to Temporal frontend (TBD)