Build the Catalogue agent: A2A in, MCP out, inference through Kong

First of the six agents, and the one that gives the A2A facade for the
others to interoperate with. A turn exchanges the user's token once per
audience, builds one MCP toolset per server with those tokens, runs the
model through the Kong AI gateway, and drops the toolsets.

Per-turn MCP clients are the point, not an implementation detail: a token
that outlives its turn can be replayed after the session ended. Several
narrow tokens rather than one broad one, so a prompt injection that talks
the agent into the wrong domain is refused at Kong rather than succeeding
quietly.

a2a-sdk rather than FastA2A, revising the May decision. That decision
rested on Agent.to_a2a() being removed in PydanticAI v2 — which has now
happened, so the argument no longer separates them. With four other
runtimes due to interoperate, the protocol author's implementation is the
safer base. httpx2 rather than httpx, which PydanticAI deprecates for
OpenAI-compatible providers and drops in v3.

Four things about a2a-sdk 1.1 that no documentation gave and that were
established against the running library, all recorded where they bite:
a2a.types are protobuf, not pydantic; DefaultRequestHandler speaks 0.3 and
V2 is needed for 1.0; a client must send A2A-Version: 1.0 or the server
assumes 0.3 and answers VERSION_NOT_SUPPORTED on a perfectly valid
request; and an executor must enqueue a Task before any status update.

Verified: the app builds with no deprecation warnings, serves its Agent
Card, and fails a turn cleanly with "no bearer token" rather than
answering from the model's own knowledge — which would hide a broken
identity chain behind a plausible reply. Seven tests cover the exchange
shape (scope not audience, per-audience caching, refusal) and the card.

The Keycloak client does not exist yet, so no end-to-end run has happened.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/catalogue_agent/config.py

@@ -0,0 +1,55 @@
+"""Runtime configuration, entirely from the environment.
+
+Nothing here has a value that would be wrong to commit, so the defaults are the
+lab's real endpoints. The two secrets — the agent's Keycloak client secret and
+nothing else — have no default and fail loudly if unset.
+"""
+
+from __future__ import annotations
+
+from pydantic import Field
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(env_prefix="CATALOGUE_", env_file=".env")
+
+    # --- identity -----------------------------------------------------------
+    keycloak_realm_url: str = "https://keycloak.sttlab.local/realms/classic-models"
+    client_id: str = "classic-models-agent-catalogue"
+    client_secret: str = Field(..., description="Keycloak client secret; no default on purpose")
+
+    # --- data ---------------------------------------------------------------
+    # One entry per MCP server this agent may reach. The audience is requested
+    # as a SCOPE, not through the `audience` parameter — Keycloak answers
+    # "Requested audience not available" to the latter. See identity.py.
+    mcp_catalog_url: str = "https://catalog-dev.sttlab.local/catalog-mcp"
+    mcp_catalog_scope: str = "mcp-catalog-audience"
+    mcp_sales_url: str = "https://sales-dev.sttlab.local/sales-mcp"
+    mcp_sales_scope: str = "mcp-sales-audience"
+
+    # --- inference ----------------------------------------------------------
+    # Always the Kong AI gateway, never a provider directly: it carries the rate
+    # limits, the prompt guards and the audit trail. It speaks the OpenAI
+    # protocol, which is why the OpenAI provider is used against it.
+    llm_base_url: str = "https://llm-dev.sttlab.local/llm/v1"
+    llm_model: str = "google/gemini-3.7-flash"
+    llm_api_key: str = Field("unused", description="Kong authenticates the caller, not this key")
+
+    # --- transport ----------------------------------------------------------
+    # The lab uses a private CA (sttlab-local-ca). Point this at the CA bundle
+    # rather than disabling verification.
+    ca_bundle: str | None = None
+    host: str = "0.0.0.0"
+    port: int = 8080
+    # Advertised in the Agent Card, so it must be the URL other agents reach,
+    # not the bind address.
+    public_url: str = "http://localhost:8080/"
+
+    @property
+    def token_endpoint(self) -> str:
+        return f"{self.keycloak_realm_url}/protocol/openid-connect/token"
+
+    @property
+    def verify(self) -> str | bool:
+        return self.ca_bundle if self.ca_bundle else True