Go fast-path sidecar for the auth /validate hot path (with Python fallback)

## Problem

nginx fires an `auth_request` subrequest to the auth-server's `GET /validate` on **every** proxied request through the gateway (`auth_server/server.py:2890`). That handler runs on a **single uvicorn worker** (`server.py:4830`, no `workers=`), so it is GIL-bound to one core. The repo's own stress baseline recorded it topping out at **~172.7 rps at concurrency 50** (`tests/stress/results/validate/baseline.json`), and at high concurrency p99 latency climbs into the second range.

Because gateway mode is the dominant deployment shape, this single endpoint is effectively the throughput ceiling of the entire authenticated data path. As traffic grows, it becomes the gateway's dominant scaling limit.

## Proposed solution

Introduce a small **Go fast-path sidecar** that fronts `/validate`:

- Verifies the token type that carries the traffic (RS256 JWT from the configured IdP), builds the exact identity headers nginx consumes, and mints the HS256 internal token — all **byte-identical** to the Python output.
- **Reverse-proxies everything it does not implement** (session cookies, other IdPs, opaque/introspection tokens, OBO, admin/federation tokens) to the unchanged Python auth-server. Blast radius is zero: you cannot break what you did not implement.
- The cutover is **one line of nginx config** (`proxy_pass`, `docker/nginx_rev_proxy_http_only.conf:~522`) plus a reload; instant rollback.

The RS256 verification is IdP-agnostic; each additional IdP is a config entry + a small claim-map, not a rewrite. Anything not yet fast-pathed simply falls through to Python and keeps working.

## User stories

- As a **gateway operator**, I want the per-request auth check to sustain far higher throughput and lower tail latency, so the gateway stops being the bottleneck as traffic grows.
- As a **platform owner**, I want to adopt the speedup with a one-line, instantly-reversible change and no behavior difference, so I take on zero migration risk.
- As a **maintainer**, I want unsupported auth flows to keep working unchanged, so the fast path never regresses correctness for any deployment.

## Acceptance criteria

- [ ] A Go sidecar serves `GET /validate` and returns **byte-identical** status + identity headers + body vs Python for the RS256 fast path (machine-checked diff, ≥3 token/group/scope shapes).
- [ ] The 4 negative cases (tampered signature, malformed JWT, expired token, missing `Authorization`) return the same status on both.
- [ ] All non-fast-path requests (cookie / other IdP / opaque / unknown `kid`) are transparently reverse-proxied to Python and succeed unchanged.
- [ ] After the nginx `proxy_pass` flip, a real MCP request through the gateway front door succeeds (the `airegistry-tools` canary returns `serverInfo`), and a fallback request also succeeds.
- [ ] Benchmark shows a large, honestly-reported throughput/latency/CPU/memory win, including the 401-path fairness run and a `uvicorn --workers N` comparison.
- [ ] Fail-closed preserved: recognized-but-invalid → 401; unrecognized → defer to Python, never a silent allow.
- [ ] Security: strip client-supplied identity/trust headers before minting; validate `SECRET_KEY` (missing/weak) at startup; never log secrets/tokens/claims.

## Out of scope

- Replacing the full Python handler (federation/admin static tokens, session cookies, OBO exchange, per-tool ACL, rate limiting, audit) — these stay in Python via fallback.
- Terraform/ECS and Helm/EKS wiring, unified parameter reference, System Config page (deferred to productionization).
- Accelerating IdPs beyond the one that carries traffic (added incrementally as config + a claim map).

## Notes

- Baseline reference: `tests/stress/results/validate/baseline.json` (~172.7 rps @ c=50).
- Design docs (LLD, testing plan, expert review) prepared under `.scratchpad/` (not committed).
- Suggest adding a `go` label for Go-related work.