auth: switch to Authentik OAuth for LLM API

- Add lib/auth.ts: OAuth client with token caching
- Use client_credentials grant with portfolio-agent service account
- Mount portfolio-agent-oidc secret for credentials
- Remove static LLM_API_TOKEN dependency

infra/portfolio/base/deployment.yaml

@@ -26,11 +26,22 @@ spec:
             secretKeyRef:
               name: portfolio-secrets
               key: FORGEJO_TOKEN
-        - name: LLM_API_TOKEN
+        # OAuth credentials for LLM API (client_credentials grant)
+        - name: AUTHENTIK_CLIENT_ID
           valueFrom:
             secretKeyRef:
-              name: portfolio-secrets
-              key: LLM_API_TOKEN
+              name: portfolio-agent-oidc
+              key: CLIENT_ID
+        - name: AUTHENTIK_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: portfolio-agent-oidc
+              key: CLIENT_SECRET
+        - name: AUTHENTIK_TOKEN_URL
+          valueFrom:
+            secretKeyRef:
+              name: portfolio-agent-oidc
+              key: TOKEN_URL
         ports:
         - name: http
           containerPort: 3000