refactor: simplify auth - remove undefined TenantID concept

- Remove TenantID field from LLMAuth (JWT claims handle tenant info)
- Remove Scopes field (not part of Poimen's design)
- Simplify to 3 core auth types: Bearer, API Key, Custom
- Update LLMRouterConfig to only include Auth field
- Simplify README examples to per-deployment pattern
- Focus on secure token management vs multi-tenant isolation
- Clarify token rotation pattern for long-running workflows
- Update security section with practical vault integration examples

TenantID was introduced without proper context. In Poimen:
- JWT token itself contains tenant/customer info in claims
- Each deployment gets its own LLM_AUTH_TOKEN from vault
- LLM API provider (riotpiao.com) validates token at their end
- No need for separate tenant header in Poimen layer

Simpler, clearer, more maintainable.

internal/routing/llm_router.go

@@ -69,7 +69,6 @@ type LLMRouterConfig struct {
 	Validators     []WorkflowValidator
 	ParamBinder    ParameterBinder
 	Auth           *LLMAuth // Authentication config for LLM API
-	TenantID       string   // Tenant ID for multi-tenant isolation
 }
 
 // NewLLMRouter creates a new LLM router with custom config