zeekay a27676c2af feat(alpaca_omnisub): JWT P-256 auth + pluggable httpauth package ...

- New pkg/provider/httpauth/ with Authenticator interface and 3 impls:
  * Basic (legacy HTTP-Basic for Kraken, old Alpaca, etc.)
  * ClientSecret (OAuth2 client_secret_post, e.g. Alpaca's Client Secret tier)
  * JWT (RFC 7523 private_key_jwt, e.g. Alpaca's JWT P-256 tier)
- alpaca_omnisub: Config gains ClientID + PrivateKeyPEM; do() unifies
  auth via Authenticator — one codepath covers Basic OR JWT Bearer.
- Alpaca quirk captured: omit `kid` from JWT header (authx rejects it with
  invalid_request even though RFC 7523 permits).
- Token URL auto-selects authx.sandbox vs authx prod by base URL.
- Token cache with 60s safety refresh window; 15-min Alpaca TTL.
- Verified live against both devnet (CKVH...) and testnet (CKZR...)
  client credentials: token exchange 200, live /v1/clock, /v1/accounts,
  and real equity orders placed under Bearer auth.

2026-04-13 15:16:08 -07:00

..

auth.go

feat(alpaca_omnisub): JWT P-256 auth + pluggable httpauth package

2026-04-13 15:16:08 -07:00