fix(llm): validate tokens against the classic-models realm, not the stale VPS one

The AI gateway's openid-connect plugin still carried the cluster-wide
dataplane-template-defaults issuer, https://keycloak.sttlab.eu/realms/sttlab.
Every other domain gateway overrides it to the lab realm; this one was missed.

The plugin therefore fetched JWKS from a realm that never signed the token and
rejected it with "invalid signature", which reaches the caller as a bare 401
"Authentication required". Combined with the missing llm-proxy audience in the
realm, the OIDC path on this gateway had never authenticated anyone — only the
key-auth path LibreChat uses was ever exercised.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dev/proxy-kustomization.yaml

@@ -21,7 +21,12 @@ spec:
       NAME: llm-dev
       NAMESPACE: llm
       CONTROL_PLANE_REF_NAME: llm-dev-cp
-      OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab
+      # The classic-models realm on the lab Keycloak, not the stale VPS realm
+      # inherited from dataplane-template-defaults. Every domain gateway
+      # overrides it the same way; this one was missed, so its openid-connect
+      # plugin validated against the wrong JWKS and answered 401 to every
+      # token — visible only as "invalid signature" in the gateway log.
+      OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
       AGENT_AUDIENCE: '["llm-proxy"]'
       OPENROUTER_UPSTREAM_URL: https://openrouter.ai/api/v1/chat/completions
       # Cost per 1M tokens for the model behind OPENROUTER_UPSTREAM_URL, used by