[0.7] DPoP enforcement on all A2A endpoints

[Raulgooo]

Release

0.7 — A2A Auth Layer

Objective

Every A2A call carries DPoP proof.

Problem

• A2A calls may use bearer tokens
• No proof-of-possession for A2A

Fix

1. Enforce DPoP on all A2A endpoints
2. RequireDPoPMiddleware on A2A routes
3. Return use_dpop_scheme if missing

Files

• internal/api/a2a_handlers.go
• internal/api/router.go

Acceptance Criteria

• All A2A endpoints require DPoP
• Missing proof → 401 use_dpop_scheme
• Tests for DPoP enforcement