[0.7] A2A delegation token with provenance chain

[Raulgooo]

Release

0.7 — A2A Auth Layer

Objective

Short-lived delegation tokens for A2A calls.

Problem

• No standard A2A delegation token
• Long-lived tokens used for A2A

Fix

1. A2A delegation token with act claim
2. Short TTL (5 min default)
3. Provenance chain
4. Single-use option

Files

• internal/oauth/a2a_exchange.go (new)
• internal/api/a2a_handlers.go

Acceptance Criteria

• A2A delegation token issuance
• Short TTL
• act claim with provenance
• Single-use enforcement
• SDK: agent.delegateForA2A()