feat: add optional OIDC bearer authentication

[franciscojavierarceo]

Summary

• add opt-in OIDC bearer authentication for every defined /v1/* HTTP and WebSocket route while keeping /health and /ready public
• validate asymmetric JWTs through secure discovery and bounded, cached, single-flight JWKS refreshes; preserve protocol-specific OpenAI, Anthropic, and Responses WebSocket error contracts
• enforce OIDC_AUDIENCE as the complete audience trust set and validate every presented azp
• consume identity credentials at the gateway boundary, keep OpenAI upstream credentials operator-owned, and preserve explicit Anthropic upstream x-api-key pass-through
• retain token expiration for long-lived WebSocket sessions and emit the canonical Responses error event after expiry
• document server configuration plus Codex and Claude Code client setup
• document a tested GitHub OAuth -> Dex OIDC -> agentic-api deployment flow, including PKCE login and production guidance

This is the first focused slice of #104 under the #102 authentication umbrella. Tenant and persisted-state ownership remain intentionally tracked by #107.

Refs #102
Refs #104

Test Plan

• cargo fmt --all -- --check
• cargo clippy --all-targets -- -D warnings
• cargo test
• uvx pre-commit run --all-files
• uv run --with-requirements docs/requirements.txt mkdocs build
• live local GitHub OAuth login through Dex v2.45.1 using authorization code with PKCE
• unauthenticated and authenticated /v1/models checks, plus authenticated /v1/responses/compact
• upstream credential-separation check proving the OIDC ID token was not forwarded
• regression coverage for strict audience/azp validation, cancellation-safe and bounded JWKS refreshes, Anthropic request IDs, OpenAI/Anthropic upstream credential policy, and post-upgrade WebSocket expiry
• read-only Claude review: no actionable findings
• gstack testing, maintainability, security, performance, migration, and red-team passes; all actionable findings fixed and final reruns clean

The optional gstack Codex export was not run because the local approval policy blocked sending the repository diff to an external service.

[maralbahari]

Thanks for the PR. left some inline comments