feat: add JWT/OAuth2 authentication & multi-tenant federation

- Add LLMAuth struct with support for Bearer, API Key, and Custom auth types
- Implement applyAuth() to inject auth headers into LLM requests
- Add X-Tenant-ID header for multi-tenant isolation
- Add X-OAuth-Scopes header for OAuth2 scope enforcement
- Add UpdateAuth() for runtime token refresh (long-running workflows)
- Update LLMRouterConfig with Auth and TenantID fields
- Document 4 authentication patterns (Bearer, API Key, Custom, Router config)
- Add security best practices: token vault integration, tenant isolation, scopes
- Add audit headers for compliance & logging
- Create multi-tenant router factory pattern

Auth types supported:
- Bearer: JWT/OAuth2 tokens (most secure for federated access)
- API Key: Static keys (X-API-Key header)
- Custom: Any custom header-based scheme
- None: No authentication

Customers can now pass per-tenant JWT tokens with customized scopes
and isolated LLM API access per tenant/customer.

internal/routing/llm_router.go

@@ -68,6 +68,8 @@ type LLMRouterConfig struct {
 	SpecBuilder    SpecBuilder
 	Validators     []WorkflowValidator
 	ParamBinder    ParameterBinder
+	Auth           *LLMAuth // Authentication config for LLM API
+	TenantID       string   // Tenant ID for multi-tenant isolation
 }
 
 // NewLLMRouter creates a new LLM router with custom config