…uth0 client provisioning

- Introduced a new `bootstrap.sh` script for idempotent provisioning of Auth0 resources, including a resource server and client pairs.
- Added `apps.json` to define the resource server and client configurations.
- Updated `.gitignore` to exclude the generated `.env.livepeer` file.
- Created a README.md to document usage and prerequisites for the new provisioning setup.

This update streamlines the process of setting up Auth0 clients and resource servers, ensuring a smooth integration with the Livepeer clearinghouse API.

…co-location

Add the Go Builder API beside Benthos in openmeter-collector: provision Auth0
end-users, upsert OpenMeter customers, and mint signer JWTs via client_credentials.
Extend bootstrap.sh with a Management API M2M client and wire compose port 8095.

…otstrap

Replace builder-sdk with in-repo protocol and jose verifiers so minted Auth0
signer JWTs resolve to auth_id alongside sk_* API keys. Add bootstrap script
for the Credentials Exchange Action and document OIDC env for the local stack.

- Updated the OpenMeter collector to include a new endpoint for exchanging OIDC access tokens for signer sessions, allowing for better integration with Auth0.
- Added a `DISCOVERY_URL` to the environment configuration for service discovery.
- Enhanced the README documentation to reflect the new OIDC signer session functionality and updated environment variable requirements.
- Improved the identity verification process by implementing a fallback mechanism for subject claims in the OIDC verifier.
- Introduced tests for the new OIDC verification logic to ensure robust functionality.

…nce API key resolution

- Updated the API to consolidate the signer-session endpoint, allowing both API keys and OIDC tokens to be exchanged for signer JWTs.
- Enhanced the resolver logic to prioritize JWT verification over API key resolution, improving security and flexibility.
- Updated the OpenAPI documentation to reflect the new endpoint structure and authentication methods.
- Added tests for the new API key resolution and OIDC verification logic to ensure robust functionality.
- Revised README files to clarify usage and configuration for the updated signer-session functionality.

…er JWTs

- Introduced a new endpoint for exchanging OIDC access tokens and API keys for signer JWTs, enhancing integration with Auth0.
- Updated the OpenAPI documentation to reflect the new token exchange functionality and its requirements.
- Enhanced error handling for invalid requests and improved client credential validation.
- Added comprehensive tests for the token exchange logic to ensure robust functionality and compliance with RFC 8693.
- Revised README files to clarify usage and configuration for the new token exchange feature.

- Replaced the previous buildEndUserVerifier function with createEndUserVerifierFromEnv to streamline the configuration of verifiers based on the IDENTITY_AUTH_MODE environment variable.
- Removed the first-match verifier logic, enforcing a strict selection between OIDC and API key verifiers.
- Updated server initialization to log the selected authentication mode.
- Enhanced error handling for missing required environment variables in both API key and OIDC modes.
- Added tests for the new verifier setup, ensuring proper functionality and error management.

…lowance on session exchange

Add no-database session provisioning keyed by clientId:externalUserId so user-scoped usage and trial credits are enforced before signer JWT mint.

…-webhook

- Updated the configuration to support identity-webhook for verifying end-user JWTs, enhancing security and flexibility.
- Removed deprecated trial feature keys and related configurations from the environment setup.
- Simplified the provisioning logic by eliminating unnecessary trial grant handling.
- Revised OpenAPI documentation to reflect changes in the token exchange process and updated environment variable requirements.
- Enhanced README documentation to clarify the new identity verification process and configuration options.

…se configuration

- Added support for loading multiple environment files in the entrypoint script, improving flexibility for configuration management.
- Updated docker-compose.yml to expose port 8095 and include a new environment file for the auth0-provisioner, facilitating better integration and service communication.
- Implemented cleanup logic in the entrypoint script to manage child processes effectively, ensuring graceful shutdowns.

…binding and SPAT issuance

- Introduced a new service for managing per-tenant Konnect organizations, allowing tenants to bind their organizations and issue Provisioner, Usage, and Ingest SPATs.
- Added routes for binding organizations, issuing credentials, and managing catalog provisioning.
- Implemented encryption for sensitive data at rest and ensured proper role assignments for system accounts.
- Enhanced README documentation to provide clear instructions on usage and configuration for the new service.
- Included tests to validate the functionality and isolation of tenant credentials.

… provisioning and trial management

- Implemented a new session service in the builder-api to provision OpenMeter customers and subscriptions, including trial credits management.
- Updated environment configuration to support trial feature keys and allowance enforcement.
- Enhanced the token exchange process to check for trial credits before minting signer JWTs, returning appropriate error responses when allowances are exhausted.
- Added new endpoints and updated existing ones to facilitate OpenMeter lookups and session provisioning.
- Improved documentation to reflect changes in the provisioning logic and environment variable requirements.
- Included comprehensive tests to validate the new session provisioning and trial grant functionalities.