- Add injected_filter, user, and groups claims to JwtClaims
- Implement filter template rendering in oauth_proxy mode
- Replace {groups} with JSON-encoded groups array
- Replace {user} with user identifier
- Bake rendered filter into JWT injected_filter claim
- Apply injected_filter in search handler
- AND injected_filter with user-supplied filter on every search
- Pass filter through JWT claims extension
- Add config validation: scoped_key_rotate_before_expiry_days < scoped_key_max_age_days
- Add JwtClaimsExtension to pass claims from middleware to handlers
- Update auth middleware to insert JWT claims into request extensions
- Update sign_jwt to accept new optional filter fields
Closes: miroir-uhj.21.3
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
ec3ecedfd7