Web-gateway routes through api-gateway for the foxhunt.tli proto, but api-gateway requires JWT Bearer auth on all gRPC requests. This adds a service_auth module that mints short-lived service JWTs (matching the api-gateway's expected claims: iss, aud, roles, permissions) and injects them into all 15 REST proxy calls and 4 gRPC stream bridges. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>