feat: add optional OIDC bearer authentication

[franciscojavierarceo]

Summary

• add opt-in OIDC bearer authentication for every /v1/* HTTP and WebSocket route while keeping /health and /ready public
• validate asymmetric JWTs through secure discovery and bounded, cached, single-flight JWKS refreshes; preserve protocol-specific OpenAI and Anthropic error envelopes
• consume identity credentials at the gateway boundary, keep upstream service credentials separate, and retain token expiration for long-lived WebSocket sessions
• document server configuration plus Codex and Claude Code client setup

This is the first focused slice of #104 under the #102 authentication umbrella. Tenant and persisted-state ownership remain intentionally tracked by #107.

Refs #102
Refs #104

Test Plan

• cargo test
• cargo clippy --all-targets -- -D warnings
• uvx pre-commit run --all-files
• uv run --with-requirements docs/requirements.txt mkdocs build
• read-only Claude review and gstack pre-landing specialist, adversarial, and structured reviews