JWT audience fix

dev/api-gateway/policies-kustomization.yaml

@@ -27,15 +27,14 @@ spec:
       # comment. Automate this lookup once the self-service pipeline exists.
       CONTROL_PLANE_REF_NAME: customers-dev-tw8tn
       # Every audience valid anywhere in the customers domain — grows as the
-      # domain gains APIs.
-      JWT_AUDIENCE_WHITELIST: '["customers-api"]'
-      # Deliberate override of dataplane-template-defaults' OIDC_ISSUER (VPS
-      # Keycloak) — the customers-api client lives only in the local
-      # in-cluster Keycloak (ns keycloak, keycloak.sttlab.local/realms/
-      # classic-models, deployed 2026-08-23), a separate IdP instance from
-      # the VPS one the other domains (catalog, librechat) authenticate
-      # against. Confirmed reachable in-cluster (OIDC discovery, 200) before
-      # wiring this in.
+      # domain gains APIs. mcp-customers added 2026-08-23 alongside the
+      # customers-mcp Kong layer (customers-api/kong/mcp/).
+      JWT_AUDIENCE_WHITELIST: '["customers-api", "mcp-customers"]'
+      # OIDC_ISSUER override, not dataplane-template-defaults' stale VPS
+      # value — the local in-cluster Keycloak (ns keycloak,
+      # keycloak.sttlab.local/realms/classic-models) is the platform-wide
+      # IdP now (see ../../../STATUS.md sections 15/16), confirmed
+      # reachable in-cluster before wiring this in.
       OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
     substituteFrom:
       - kind: ConfigMap