[L3] Auth refactor: rename ClerkAuth → OidcJwksAuth, add OIDC_ISSUER_URL env var fallback

[gbram1]

Part of an AI-generated stack — level 3 of 5.
Depends on: Level 2. Merges into: stack/pr-3/L02-types-store-layer-introduce-deploymentmo.

Goal

Replace the Clerk-specific auth module with a vendor-neutral OIDC/JWKS module and update all API surface that references it.

Risk

medium — Renames the public ClerkAuth export (breaking for any downstream binary referencing it) and removes the require_admin guard on agent/metrics endpoints, which is a meaningful access-control change.

Rationale

Depends on L2 because handlers/organizations.rs now references DeploymentMode and external_id. The file rename clerk.rs → oidc.rs is the dominant change in oidc.rs. Reviewers must pay attention to: (a) the OIDC_ISSUER_URL / CLERK_ISSUER_URL fallback logic in OidcJwksAuth::from_env; (b) removal of require_admin from agents/metrics handlers — the rationale is that auth middleware now covers these, but the reviewer should verify those routes are behind SmartAuthLayer or AuthLayer in lib.rs; (c) the protobuf validation improvement in produce.rs and schema registry, which logically belong to a separate concern but cannot be split without hunk-level splits — called out here.

Files (15)

• crates/streamhouse-api/src/oidc.rs
• crates/streamhouse-api/src/auth.rs
• crates/streamhouse-api/src/lib.rs
• crates/streamhouse-api/src/bin/api.rs
• crates/streamhouse-api/src/handlers/agents.rs
• crates/streamhouse-api/src/handlers/metrics.rs
• crates/streamhouse-api/src/handlers/topics.rs
• crates/streamhouse-api/src/handlers/organizations.rs
• crates/streamhouse-api/src/handlers/produce.rs
• crates/streamhouse-api/tests/api_integration_test.rs
• crates/streamhouse-schema-registry/src/registry.rs
• crates/streamhouse-schema-registry/tests/integration_test.rs
• crates/streamhouse-agent/tests/lease_coordination_test.rs
• docker-compose.prod.yml
• docs/authentication.md