IDtrack API gateway. Routes: /api/v1/auth + users/tenants/roles → Core; /api/v1/* → Cortex; /.well-known/* → JWKS