[0.7] A2A scope + resource attenuation per hop

[Raulgooo]

Release

0.7 — A2A Auth Layer

Objective

A2A delegation narrows scopes and resources at each hop.

Problem

• Delegation preserves full scopes
• No attenuation

Fix

1. Scope narrowing at each delegation
2. Resource restriction
3. Enforce in token issuance
4. Validate in middleware

Files

• internal/oauth/a2a_exchange.go
• internal/api/a2a_handlers.go

Acceptance Criteria

• Scopes narrowed per hop
• Resource restriction enforced
• Validation in middleware
• SDK support