docs: add JWT auth token to LLM inference activities

API.md

@@ -805,11 +805,20 @@ Single-prompt LLM inference within a workflow.
     "system_prompt": "You are a code analysis expert. Provide detailed feedback.",
     "user_prompt": "Analyze this code for security issues: {{ previous_output.code }}",
     "temperature": 0.7,
-    "max_tokens": 2048
+    "max_tokens": 2048,
+    "auth_token": "{{ user.jwt_token }}"
   }
 }
 ```
 
+**Fields:**
+- `model` (required): Model ID (reasoning, ornith:35b, ornith:13b, qwen2.5:3b)
+- `system_prompt`: System instruction for the model
+- `user_prompt` (required): User message to send
+- `temperature`: Sampling temperature (0.0-1.0, default 0.7)
+- `max_tokens`: Maximum output tokens
+- `auth_token` (optional): JWT token for authenticated endpoints (propagates as Authorization: Bearer header)
+
 **Backend Implementation:**
 The LLMInferenceActivity in the workflows backend automatically:
 1. Substitutes template variables (e.g., `{{ previous_output.code }}`)
@@ -853,11 +862,19 @@ Multiple-prompt LLM inference (sequential processing).
       "Review snippet 1: {{ files[0].content }}",
       "Review snippet 2: {{ files[1].content }}",
       "Review snippet 3: {{ files[2].content }}"
-    ]
+    ],
+    "auth_token": "{{ user.jwt_token }}"
   }
 }
 ```
 
+**Fields:**
+- `model` (required): Model ID
+- `system_prompt`: System instruction (same for all prompts)
+- `prompts` (required): List of user prompts to process
+- `temperature`: Sampling temperature (0.0-1.0)
+- `auth_token` (optional): JWT token for authenticated endpoints (propagates as Authorization: Bearer header)
+
 **Output:**
 ```json
 {
@@ -898,6 +915,56 @@ Retrieve Memory → LLM Context Extraction → Route to Activity A/B/C → Notif
 
 ---
 
+### Authentication & Authorization
+
+JWT tokens can be passed to LLM inference activities and are automatically propagated to the LLM API endpoint.
+
+**Token Flow:**
+```
+Workflow Canvas
+  ↓ (auth_token field)
+Poimen Workflow Executor
+  ↓ (passed to LLMInferenceActivity)
+Activity calls LLM client
+  ↓ (adds "Authorization: Bearer {token}" header)
+homelab-frontend proxy
+  ↓ (preserves Authorization header)
+LLM Backend (reasoning/ollama/etc)
+  ↓ (validates token)
+Response returned
+```
+
+**Example: Passing User Token from RetrieveMemory Activity**
+```json
+{
+  "id": "flow-1",
+  "type": "retrieve-memory",
+  "label": "Get User Context",
+  "data": {...}
+}
+→
+{
+  "id": "llm-1",
+  "type": "llm-inference",
+  "label": "Analyze with User's Token",
+  "data": {
+    "model": "reasoning",
+    "user_prompt": "...",
+    "auth_token": "{{ previous_output.user_token }}"
+  }
+}
+```
+
+**Token Validation:**
+- Tokens are validated by homelab-frontend proxy (checks signature, expiration)
+- Only valid tokens are propagated to LLM backend
+- Invalid tokens result in 401 Unauthorized error
+- Missing token (if required) results in 401 Unauthorized
+
+**Note:** The `auth_token` field is optional. If omitted, the LLM API is called without authentication (public endpoints only).
+
+---
+
 ### Error Handling
 
 If LLM inference fails: