Demo: propagating identity from gateway to inventory

Step by step

1. Show the gateway validating the user token and forwarding it.
2. Configure orders as a resource server; call inventory with client credentials for stock checks.
3. Configure inventory to require its own scope and audience.
4. Planned mistake: inventory trusts an X-User-Id header; call it directly with curl and a forged header: it works. Fix by validating tokens.
5. Call each service directly without a token: all return 401.
6. Show an admin endpoint rejecting a token that lacks the admin scope (403).