- Handle getAccessToken failure gracefully
- Support LLM_API_TOKEN env var for local dev (bypasses OAuth)
- Better error messages for missing credentials
- Add lib/auth.ts: OAuth client with token caching
- Use client_credentials grant with portfolio-agent service account
- Mount portfolio-agent-oidc secret for credentials
- Remove static LLM_API_TOKEN dependency