- Add lib/auth.ts: OAuth client with token caching - Use client_credentials grant with portfolio-agent service account - Mount portfolio-agent-oidc secret for credentials - Remove static LLM_API_TOKEN dependency