refactor: simplify auth - remove undefined TenantID concept

- Remove TenantID field from LLMAuth (JWT claims handle tenant info)
- Remove Scopes field (not part of Poimen's design)
- Simplify to 3 core auth types: Bearer, API Key, Custom
- Update LLMRouterConfig to only include Auth field
- Simplify README examples to per-deployment pattern
- Focus on secure token management vs multi-tenant isolation
- Clarify token rotation pattern for long-running workflows
- Update security section with practical vault integration examples

TenantID was introduced without proper context. In Poimen:
- JWT token itself contains tenant/customer info in claims
- Each deployment gets its own LLM_AUTH_TOKEN from vault
- LLM API provider (riotpiao.com) validates token at their end
- No need for separate tenant header in Poimen layer

Simpler, clearer, more maintainable.

internal/routing/llm_client.go

@@ -53,12 +53,6 @@ type LLMAuth struct {
 	
 	// HeaderValue is the custom header value for Custom auth
 	HeaderValue string `json:"headerValue,omitempty"`
-	
-	// TenantID is the tenant/customer ID for multi-tenant federated access
-	TenantID string `json:"tenantId,omitempty"`
-	
-	// Scopes are the OAuth2 scopes (space-separated)
-	Scopes string `json:"scopes,omitempty"`
 }
 
 // LLMClient is a simple LLM client for routing
@@ -216,16 +210,6 @@ func (c *LLMClient) applyAuth(req *http.Request) error {
 		req.Header.Set(c.auth.HeaderName, c.auth.HeaderValue)
 	}
 
-	// Add tenant ID if specified (for multi-tenant federated access)
-	if c.auth.TenantID != "" {
-		req.Header.Set("X-Tenant-ID", c.auth.TenantID)
-	}
-
-	// Add scopes if specified (for OAuth2 flows)
-	if c.auth.Scopes != "" {
-		req.Header.Set("X-OAuth-Scopes", c.auth.Scopes)
-	}
-
 	return nil
 }
 

internal/routing/llm_router.go

@@ -69,7 +69,6 @@ type LLMRouterConfig struct {
 	Validators     []WorkflowValidator
 	ParamBinder    ParameterBinder
 	Auth           *LLMAuth // Authentication config for LLM API
-	TenantID       string   // Tenant ID for multi-tenant isolation
 }
 
 // NewLLMRouter creates a new LLM router with custom config