docs: Add M7 source connectors (10 tasks), M3.5.10 auth integration, remove Kong refs

- M7.1-M7.10: Extensible SourceConnector trait, Obsidian/paperless/git/S3
  connectors, sync framework, CLI, HTTP endpoints, health monitoring, gate
- M3.5.10: Auth integration with Authentik OIDC → Vault token validation
- DESIGN.md: Add source connectors architecture, update auth to
  Authentik/Vault (Kong removed from cluster)
- INDEX.md: 75 tasks, 11 gates
- Fix all Kong references in M3.5.1 task

tasks/INDEX.md

@@ -62,7 +62,7 @@ Legend: ⬜ not started · 🟡 in progress · ✅ done · ⛔ blocked
 | 2 | Gated loop at L1 | M1.x | 8 | 8 | 0 | 0 | ✅ M1.8 |
 | 3 | Projections | M2.x | 8 | 5 | 0 | 3 | ✅ M2.8 (M2.1, M2.3, M2.4, M2.5 ✅) |
 | 4 | L2 synthesis + retrieval | M3.x | 4 | 4 | 0 | 0 | ✅ M3.4 |
-| 4.5 | Distributed API Layer | M3.5.x | 9 | 8 | 0 | 1 | ✅ M3.5.8 |
+| 4.5 | Distributed API Layer | M3.5.x | 10 | 8 | 0 | 2 | ✅ M3.5.8 |
 | 5 | Skills | M4.x | 3 | 2 | 0 | 1 | ⬜ M4.3 |
 | 5.5 | Reference corpora | M3.6.x | 6 | 1 | 0 | 5 | ⬜ M3.6.6 |
 | 5.6 | Tool context | M3.7.x | 6 | 0 | 2 | 4 | ⬜ M3.7.6 |
@@ -146,7 +146,7 @@ Homelab frontend integration: HTTP facade via `api.riotpiao.com`. Runs in parall
 
 | Task | Title | Size | Flags | Status |
 |---|---|---|---|---|
-| [M3.5.1](M3.5.1-http-server.md) | HTTP server + router, Kong auth, metrics | M | — | ✅ |
+| [M3.5.1](M3.5.1-http-server.md) | HTTP server + router, auth hook, metrics | M | — | ✅ |
 | [M3.5.2](M3.5.2-ingest-endpoint.md) | POST /ingest async queue | M | — | ✅ |
 | [M3.5.3](M3.5.3-query-endpoint.md) | GET /query HNSW+rerank | M | — | ✅ |
 | [M3.5.4](M3.5.4-query-federation.md) | Query federation | M | — | ✅ |
@@ -155,6 +155,7 @@ Homelab frontend integration: HTTP facade via `api.riotpiao.com`. Runs in parall
 | [M3.5.7](M3.5.7-rate-limiting.md) | Rate limiting | M | — | ✅ |
 | [M3.5.8](M3.5.8-m3.5-gate.md) | **M3.5 composition gate** | M | gate | ✅ |
 | [M3.5.9](M3.5.9-git-aware-references.md) | Git-aware references: lookup by code location | M | — | ⬜ |
+| [M3.5.10](M3.5.10-auth-integration.md) | Auth: Authentik/Vault OIDC token validation | M | — | ⬜ |
 
 ## 5 — Skills · M4.x
 
@@ -254,6 +255,33 @@ durability-of-location, not a multi-host requirement.
 | [M6.5](M6.5-credentials-secret.md) | Postgres credentials for the Mac client | S | homelab | ⬜ |
 | [M6.6](M6.6-m6-gate.md) | **M6 composition gate** | M | gate | ⬜ |
 
+## 8 — Source connectors · M7.x
+
+Extensible multi-source ingestion. `SourceConnector` trait + YAML-driven registry.
+Adding a new document source (paperless-ngx, S3, git repo) requires implementing
+one trait and adding one config block — no changes to the ingest pipeline, chunking,
+embedding, storage, or query layers.
+
+**Document connectors** produce Level R content (reference material, bypasses gated
+loop). **Session connectors** (pi, claude) produce evidence for L0/L1/L2. The
+connector's `source_type()` declares the pipeline.
+
+Sync framework handles change detection (sha-based skip), tombstoning, drift
+reporting, and resumable sync for all connectors.
+
+| Task | Title | Size | Flags | Status |
+|---|---|---|---|---|
+| [M7.1](M7.1-source-connector-trait.md) | `SourceConnector` trait + registry | M | — | ⬜ |
+| [M7.2](M7.2-obsidian-connector.md) | Obsidian vault connector | M | — | ⬜ |
+| [M7.3](M7.3-paperless-connector.md) | paperless-ngx connector | M | — | ⬜ |
+| [M7.4](M7.4-git-repo-connector.md) | Git repo connector | M | — | ⬜ |
+| [M7.5](M7.5-s3-connector.md) | S3-compatible storage connector | M | — | ⬜ |
+| [M7.6](M7.6-sync-framework.md) | Sync framework | L | — | ⬜ |
+| [M7.7](M7.7-source-cli.md) | `mem source` CLI | M | — | ⬜ |
+| [M7.8](M7.8-source-http-endpoints.md) | Source HTTP endpoints | M | — | ⬜ |
+| [M7.9](M7.9-connector-health-monitoring.md) | Connector health + observability | S | — | ⬜ |
+| [M7.10](M7.10-m7-gate.md) | **M7 composition gate** | M | gate | ⬜ |
+
 ---
 
 Background: [DESIGN.md](../DESIGN.md) · GRU-Mem, arXiv 2602.10560 · `internal/store/store.go` (agent-manager, `add-headless-spawn` branch)