fix: SQS gateway JWT validation, MinIO/Temporal native JWT support

Auth strategy clarified per service:
- SQS: Gateway validates JWT (kmsvc code unverified, needs Phase 3)
- MinIO: Native JWT/OIDC support (validates itself, Phase 3: load-test)
- Temporal: Native JWT via jwtKeyProvider (Phase 3: configure)
- Memory, IAM: Services validate JWTs (dumb pipe)

SQS now requires Authorization header at gateway.
Phase 3 will implement actual JWT signature validation against Authentik.

internal/serviceadapter/router.go

@@ -17,8 +17,10 @@ import (
 )
 
 // Dispatcher routes X-Service requests to upstreams.
-// Acts as a dumb pipe: passes Authorization header through unchanged.
+// Auth per service:
-// Each upstream service validates JWTs independently.
+//   SQS: Gateway validates JWT (kmsvc code unverified)
+//   MinIO, Temporal: Native JWT support (dumb pipe pass-through)
+//   Memory, IAM: Services validate JWTs themselves
 type Dispatcher struct {
 	registry *Registry
 }
@@ -89,6 +91,18 @@ func (d *Dispatcher) Dispatch(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Gateway-level JWT validation for SQS (code unverified in kmsvc)
+	// MinIO, Temporal, Memory, IAM have native JWT support - pass through
+	if adapter.Spec.Auth.Required && serviceName == "sqs" {
+		if r.Header.Get("Authorization") == "" {
+			p := problem.NewProblem(http.StatusForbidden, "about:blank#forbidden",
+				"Forbidden", "SQS requires Authorization header")
+			_ = p.Write(w)
+			return
+		}
+		// TODO: Phase 3 - validate JWT signature against Authentik JWKS for SQS
+	}
+
 	// Detect protocol from upstream URL scheme
 	upstreamURL := adapter.Spec.Upstream.URL
 	if strings.HasPrefix(upstreamURL, "grpc://") {

k8s/configmap.yaml

@@ -44,8 +44,9 @@ data:
         url: http://management-service.sqs.svc.cluster.local:9090
         timeoutSeconds: 30
       auth:
-        required: false
+        required: true
-        # Note: Services validate their own JWTs. Gateway is dumb pipe.
+        # Gateway validates (kmsvc JWT validation code unverified)
+        # TODO: Phase 3 - validate JWT signature against Authentik JWKS
       resources:
       - name: send-message
         methods:
@@ -66,6 +67,8 @@ data:
         timeoutSeconds: 60
       auth:
         required: false
+        # Temporal has native JWT support via jwtKeyProvider
+        # Phase 3: configure and test Temporal JWT validation
       resources:
       - name: execute
         methods:
@@ -106,7 +109,8 @@ data:
         timeoutSeconds: 30
       auth:
         required: false
-        # MinIO validates bearer tokens independently
+        # MinIO has native JWT/OIDC support - validates JWTs itself
+        # Phase 3: load-test MinIO JWT validation
       resources:
       - name: list-objects
         methods: