Feat: Add token-broker service for OAuth session and token management

The token-broker service provides centralized OAuth token acquisition for AI
agents via PKCE-based authorization flows, token caching with JWT
expiry parsing, and session management with long-polling coordination.

Signed-off-by: David Hadas <david.hadas@gmail.com>

Author: davidhadas

kagenti-operator/cmd/token-broker/Dockerfile

@@ -0,0 +1,25 @@
+# `--platform=$BUILDPLATFORM` pins the builder stage to the host arch so
+# Go cross-compiles to $TARGETARCH instead of running under QEMU. With
+# CGO disabled (below), the resulting binary is bit-for-bit identical to
+# a native build but ~9x faster for the arm64 variant.
+FROM --platform=$BUILDPLATFORM docker.io/golang:1.26 AS builder
+ARG TARGETOS
+ARG TARGETARCH
+
+WORKDIR /workspace
+COPY go.mod go.mod
+COPY go.sum go.sum
+RUN go mod download
+
+COPY cmd/token-broker/ cmd/token-broker/
+COPY internal/tokenbroker/ internal/tokenbroker/
+COPY pkg/oauth/ pkg/oauth/
+
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -o token-broker ./cmd/token-broker/
+
+FROM gcr.io/distroless/static:nonroot
+WORKDIR /
+COPY --from=builder /workspace/token-broker .
+USER 65532:65532
+
+ENTRYPOINT ["/token-broker"]