fix: SQS gateway JWT validation, MinIO/Temporal native JWT support

Auth strategy clarified per service:
- SQS: Gateway validates JWT (kmsvc code unverified, needs Phase 3)
- MinIO: Native JWT/OIDC support (validates itself, Phase 3: load-test)
- Temporal: Native JWT via jwtKeyProvider (Phase 3: configure)
- Memory, IAM: Services validate JWTs (dumb pipe)

SQS now requires Authorization header at gateway.
Phase 3 will implement actual JWT signature validation against Authentik.

internal/serviceadapter/router.go

@@ -17,8 +17,10 @@ import (
 )
 
 // Dispatcher routes X-Service requests to upstreams.
-// Acts as a dumb pipe: passes Authorization header through unchanged.
-// Each upstream service validates JWTs independently.
+// Auth per service:
+//   SQS: Gateway validates JWT (kmsvc code unverified)
+//   MinIO, Temporal: Native JWT support (dumb pipe pass-through)
+//   Memory, IAM: Services validate JWTs themselves
 type Dispatcher struct {
 	registry *Registry
 }
@@ -89,6 +91,18 @@ func (d *Dispatcher) Dispatch(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Gateway-level JWT validation for SQS (code unverified in kmsvc)
+	// MinIO, Temporal, Memory, IAM have native JWT support - pass through
+	if adapter.Spec.Auth.Required && serviceName == "sqs" {
+		if r.Header.Get("Authorization") == "" {
+			p := problem.NewProblem(http.StatusForbidden, "about:blank#forbidden",
+				"Forbidden", "SQS requires Authorization header")
+			_ = p.Write(w)
+			return
+		}
+		// TODO: Phase 3 - validate JWT signature against Authentik JWKS for SQS
+	}
+
 	// Detect protocol from upstream URL scheme
 	upstreamURL := adapter.Spec.Upstream.URL
 	if strings.HasPrefix(upstreamURL, "grpc://") {