Stéphane Tailland
6c89f6124d
The AI gateway's openid-connect plugin requires audience ["llm-proxy"], but no client or client scope in the realm could mint it, so every OIDC call fell through to the anonymous consumer and was terminated with 401 "Authentication required". Adds the bearer-only llm-proxy client, the llm-proxy-audience scope, and grants it to the catalogue agent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>