fix: SQS gateway JWT validation, MinIO/Temporal native JWT support

Auth strategy clarified per service:
- SQS: Gateway validates JWT (kmsvc code unverified, needs Phase 3)
- MinIO: Native JWT/OIDC support (validates itself, Phase 3: load-test)
- Temporal: Native JWT via jwtKeyProvider (Phase 3: configure)
- Memory, IAM: Services validate JWTs (dumb pipe)

SQS now requires Authorization header at gateway.
Phase 3 will implement actual JWT signature validation against Authentik.

k8s/configmap.yaml

@@ -44,8 +44,9 @@ data:
         url: http://management-service.sqs.svc.cluster.local:9090
         timeoutSeconds: 30
       auth:
-        required: false
-        # Note: Services validate their own JWTs. Gateway is dumb pipe.
+        required: true
+        # Gateway validates (kmsvc JWT validation code unverified)
+        # TODO: Phase 3 - validate JWT signature against Authentik JWKS
       resources:
       - name: send-message
         methods:
@@ -66,6 +67,8 @@ data:
         timeoutSeconds: 60
       auth:
         required: false
+        # Temporal has native JWT support via jwtKeyProvider
+        # Phase 3: configure and test Temporal JWT validation
       resources:
       - name: execute
         methods:
@@ -106,7 +109,8 @@ data:
         timeoutSeconds: 30
       auth:
         required: false
-        # MinIO validates bearer tokens independently
+        # MinIO has native JWT/OIDC support - validates JWTs itself
+        # Phase 3: load-test MinIO JWT validation
       resources:
       - name: list-objects
         methods: