docs: fix OPA/token-issuance conflation in architecture summary and PRD

OPA is the PDP and returns an allow/deny decision or entitlements; it
does not mint OAuth tokens. Token issuance under RFC 8693 is Keycloak's
role as authorization server, initiated by AuthBridge as PEP.

Signed-off-by: Oleg Blinder <olegb@il.ibm.com>

Author: oblinder

aiac/docs/specs/ARCHITECTURE-SUMMARY.md

@@ -35,7 +35,7 @@ AIAC introduces a strict three-layer model that cleanly separates policy concern
 | Layer | Component | Responsibility |
 |---|---|---|
 | **Policy Management** | AIAC Agent | Translates natural-language policy into PDP configuration on every trigger |
-| **Policy Decision (PDP)** | OPA | Evaluates LLM-generated Rego rules; issues scoped tokens |
+| **Policy Decision (PDP)** | OPA | Evaluates LLM-generated Rego rules; returns the caller's entitlements/decision |
 | **Policy Enforcement (PEP)** | AuthBridge | Intercepts traffic; exchanges tokens; carries no policy knowledge |
 
 The AIAC Agent subscribes to an event stream (NATS JetStream) and reacts to entity lifecycle

aiac/docs/specs/PRD.md

@@ -55,7 +55,7 @@ AIAC enforces a strict three-layer model:
 | **Policy Decision (PDP)** | OPA | Evaluates LLM-generated Rego rules; decides what a caller may access |
 | **Policy Enforcement (PEP)** | AuthBridge | Intercepts traffic; exchanges tokens; carries no policy knowledge |
 
-The PEP (AuthBridge) is a pure enforcement layer. It performs RFC 8693 token exchanges sending only the target `audience` — no `scope` parameter. OPA evaluates the caller's role against the Rego rules and issues a token containing exactly the entitlements that role grants on the target service.
+The PEP (AuthBridge) is a pure enforcement layer. It performs RFC 8693 token exchanges sending only the target `audience` — no `scope` parameter. OPA evaluates the caller's role against the Rego rules and returns exactly the entitlements that role grants on the target service; Keycloak, as the authorization server, issues the token scoped to those entitlements.
 
 This means `token_scopes` is absent from `authproxy-routes`. Route configuration carries routing intent only (`host` → `target_audience`). Policy intent lives entirely in OPA, kept current by AIAC.