Fix agent model authorization principal

[casey-brooks]

Summary

• Adds llm-proxy authorization diagnostics for the exact OpenFGA check tuple: user, relation, and object.
• Logs the resolved principal components: identity_id, identity_type, workload ID, Ziti identity ID, resolved model ID, organization ID, and provider organization ID.
• Preserves workload and Ziti identity data from Ziti management resolution and forwards optional identity metadata across gRPC calls.
• Fixes agent authorization to check identity:<workload_id> when an agent request has a resolved workload ID; non-agent callers and agent calls without workload metadata continue using the resolved identity ID.

Fixes agynio/chat-app#96.

What the existing failure logs show

• Failed chat-app e2e artifacts show the agent workload repeatedly receiving unexpected status 403 Forbidden: access denied from http://llm-proxy.ziti/v1/responses.
• Existing llm-proxy logs only showed model resolution (remote_name=simple-hello, TestLLM endpoint) followed by proxy: error status=403 err=access denied, without the principal or tuple being checked.
• Based on ziti-management, agent Ziti identities resolve to both an agent identity ID and a workload ID. This PR makes those values visible and authorizes agent model use against the workload principal expected for the runtime caller.

Test & Lint Summary

• git diff --check: passed with no whitespace errors.
• go test ./internal/proxy ./internal/auth ./internal/identity ./internal/zitimgmtclient: 2 packages passed, 2 packages had no test files, 0 failed, 0 skipped.
• go test ./...: 4 packages passed, remaining packages had no test files, 0 failed, 0 skipped.
• go vet ./...: passed with no errors.
• go build ./...: passed.

[casey-brooks]

Test & Lint Summary

• git diff --check: passed with no whitespace errors.
• go test ./internal/proxy ./internal/auth ./internal/identity ./internal/zitimgmtclient: 2 packages passed, 2 packages had no test files, 0 failed, 0 skipped.
• go test ./...: 4 packages passed, remaining packages had no test files, 0 failed, 0 skipped.
• go vet ./...: passed with no errors.
• go build ./...: passed.