fix: add error handling and local dev fallback for auth

- Handle getAccessToken failure gracefully
- Support LLM_API_TOKEN env var for local dev (bypasses OAuth)
- Better error messages for missing credentials

lib/auth.ts

@@ -19,8 +19,16 @@ let cachedToken: CachedToken | null = null
 /**
  * Get a valid access token, fetching a new one if expired.
  * Tokens are cached with 60s buffer before expiry.
+ * 
+ * For local dev: set LLM_API_TOKEN env var to skip OAuth.
  */
 export async function getAccessToken(): Promise<string> {
+  // Local dev fallback - use static token if set
+  const staticToken = process.env.LLM_API_TOKEN
+  if (staticToken) {
+    return staticToken
+  }
+
   const now = Date.now()
   
   // Return cached token if still valid (with 60s buffer)
@@ -33,7 +41,10 @@ export async function getAccessToken(): Promise<string> {
   const tokenUrl = process.env.AUTHENTIK_TOKEN_URL || 'https://authentik.riotpiao.com/application/o/token/'
 
   if (!clientId || !clientSecret) {
-    throw new Error('AUTHENTIK_CLIENT_ID and AUTHENTIK_CLIENT_SECRET must be set')
+    throw new Error(
+      'Missing OAuth credentials. Set AUTHENTIK_CLIENT_ID + AUTHENTIK_CLIENT_SECRET, ' +
+      'or LLM_API_TOKEN for local dev.'
+    )
   }
 
   const response = await fetch(tokenUrl, {