auth: switch to Authentik OAuth for LLM API

- Add lib/auth.ts: OAuth client with token caching
- Use client_credentials grant with portfolio-agent service account
- Mount portfolio-agent-oidc secret for credentials
- Remove static LLM_API_TOKEN dependency

app/api/chat/route.ts

@@ -1,7 +1,8 @@
 import { NextRequest } from 'next/server'
+import { getAccessToken } from '@/lib/auth'
 
-const LLM_API_URL = 'http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions'
-const MODEL = 'reasoning'
+const LLM_API_URL = process.env.LLM_API_URL || 'http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions'
+const MODEL = process.env.LLM_MODEL || 'reasoning'
 
 const SYSTEM_PROMPT = `You are **Poimen**, Rock Liang's AI assistant embedded in his portfolio. You help visitors understand Rock's journey, technical depth, and what drives him. Speak with a humble, curious tone—Rock is someone who learns by building, breaks things to understand them, and is genuinely excited about distributed systems and AI.
 
@@ -134,16 +135,9 @@ GOOD example:
 BAD: "Rock resolved the Terraform configuration drift issue by implementing automated drift detection and real-time visibility into discrepancies..." — this is garbage. Never do this.`
 
 export async function POST(request: NextRequest) {
-  const token = process.env.LLM_API_TOKEN
-
-  if (!token) {
-    return new Response(
-      JSON.stringify({ error: 'LLM_API_TOKEN not configured' }),
-      { status: 500, headers: { 'Content-Type': 'application/json' } }
-    )
-  }
-
   try {
+    // Get OAuth token (cached, auto-refreshes)
+    const token = await getAccessToken()
     const { message } = await request.json()
 
     const response = await fetch(LLM_API_URL, {