fix: Default outbound policy to passthrough, preventing token exchange failures

[mrsabath]

Summary

Fixes the root cause of kagenti/kagenti#882 from the kagenti-extensions side.

The go-processor previously attempted token exchange for all plaintext HTTP outbound traffic when global config (TARGET_AUDIENCE, TARGET_SCOPES) was set. This broke agents using in-cluster HTTP services (Ollama for LLM, otel-collector for telemetry) because non-Keycloak tokens (like API keys) were rejected with "Invalid token" or "invalid_scope" errors. External HTTPS LLM APIs (OpenAI, Anthropic) happened to work only because Envoy TLS passthrough bypasses the ext_proc entirely.

This PR inverts the default: outbound requests that don't match any route pass through unchanged. Token exchange only happens for hosts with explicit entries in an authproxy-routes ConfigMap.

Changes

• go-processor: Add DEFAULT_OUTBOUND_POLICY env var ("passthrough" default, "exchange" for legacy backward compat) and insert passthrough check in handleOutbound() for unmatched hosts
• go-processor: Add passthroughResponse() helper to reduce duplication
• go-processor: Add comprehensive unit tests (TestDefaultOutboundPolicy, TestOutboundPolicyWithRoutes, TestOutboundPolicyRouteMatchExchangeFails) using httptest mock Keycloak
• webhook: Mount optional authproxy-routes ConfigMap volume (Optional: true so pods don't fail if it doesn't exist)
• webhook: Add ROUTES_CONFIG_PATH and DEFAULT_OUTBOUND_POLICY env vars to envoy-proxy container
• github-issue demo: Add authproxy-routes ConfigMap with explicit route entry for github-tool (so token exchange still works for that demo)
• webhook demo: Add DEFAULT_OUTBOUND_POLICY documentation and commented-out authproxy-routes example
• docs: Update CLAUDE.md and AuthBridge/CLAUDE.md with new policy, ConfigMap, and behavior

How it works

Outbound HTTP request
  |
  +-- Host matches route? --> Yes, passthrough=true --> Pass through
  |                      |
  |                      +--> Yes, with audience/scopes --> Token exchange
  |
  +-- No match --> DEFAULT_OUTBOUND_POLICY?
                      |
                      +--> "passthrough" (default) --> Pass through unchanged
                      |
                      +--> "exchange" (legacy) --> Exchange with global config

Companion change needed in kagenti/kagenti

The Helm chart in charts/kagenti/templates/agent-namespaces.yaml currently creates authbridge-config with hardcoded TARGET_AUDIENCE: "auth-target" and TARGET_SCOPES: "openid auth-target-aud". With this PR, those values become fallbacks only used when a route matches but doesn't specify its own audience/scopes (or when DEFAULT_OUTBOUND_POLICY=exchange). The Helm chart should be updated to either:

1. Remove TARGET_AUDIENCE/TARGET_SCOPES from the default authbridge-config (since passthrough is now the default and routes provide per-target config), or
2. Keep them as fallback values but document that they only apply when routes are configured

The weather agent demo and all other agents will work out-of-the-box after this change without needing the auth-target-aud scope to exist in Keycloak.

Test plan

• All existing go-processor tests pass (go test ./go-processor/...)
• All existing resolver tests pass (go test ./go-processor/internal/resolver/...)
• All webhook tests pass (make test in kagenti-webhook/)
• New TestDefaultOutboundPolicy validates passthrough for Ollama, otel-collector, and arbitrary hosts
• New TestDefaultOutboundPolicyLegacyExchange validates backward compat with exchange policy
• New TestOutboundPolicyWithRoutes validates github-issue pattern (route-based exchange + LLM passthrough)
• New TestOutboundPolicyRouteMatchExchangeFails validates 503 on Keycloak errors for routed hosts
• Pre-commit hooks pass (go-fmt, go-vet, trailing-whitespace, yaml-check)
• Deploy weather agent with Ollama and verify chat works without manual ConfigMap changes
• Deploy github-issue agent with routes ConfigMap and verify token exchange works for github-tool

[huang195]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[huang195]

looks good!