feat(routing): fence intelligent_route candidates via entitlement claim

[hexfusion]

Summary

Adds a generic, config-driven fence to intelligent_route. Candidates carry a labels map, and match_claims keeps only candidates whose label equals a claim on the authenticated identity, before the model-name pick. Adding an entitlement dimension (residency, tier, sovereignty) is configuration, not code.

It fails closed. When a request carries no authenticated identity, is missing the gated claim, or matches no in-scope candidate, the gateway denies it rather than routing. A fenced-out capability returns the same 404 as an unknown one, so a caller cannot enumerate what it is fenced out of. Session-affinity reuse and weighted selection both respect the fence. The ungated path (no match_claims) is unchanged and allocates nothing new. It reuses the AuthenticatedIdentity extension token_rate_limit already reads, so it adds no new plumbing.

filters:
  - filter: intelligent_route
    model_header: X-Model
    match_claims:
      - { claim: grid_region, label: region }   # residency fence; a missing claim denies
    candidates:
      - { kind: inference_model, name: qwen, cluster: site-us, labels: { region: us-east-1 } }
      - { kind: inference_model, name: qwen, cluster: site-eu, labels: { region: eu-west-1 } }

Matching is exact-equality only. Richer operators (range, hierarchy, set membership) are out of scope and can be added later without breaking this config.

Granting a user an entitlement

The fence holds no per-user state. The entitlement rides in the caller's token as a claim, sourced from the IdP (for example a Keycloak user attribute mapped into the JWT). alice's token carries:

{ "sub": "alice", "grid_region": "eu-west-1", "tier": "gold" }

The gateway validates the token, lands grid_region on the authenticated identity, and match_claims keeps only candidates whose region label equals it, so alice routes to the eu-west-1 site. Granting or changing alice's residency is an IdP change (set the attribute), never a gateway change. A second dimension is the same move: the IdP adds grid_tier, and the config adds { claim: grid_tier, label: tier } plus a tier label on candidates.

Related issue

Closes #1282

Validation

• cargo test -p praxis-ai-filters --lib routing:: gives 405 passed. Covers matching, unlabeled-candidate exclusion, no-eligible-member, weighted-draws-stay-in-scope, validation bounds, fail-closed-without-identity, and the ungated-unchanged path.
• Example config intelligent-route-claim-gating.yaml plus a fail-closed integration test.
• make lint clean. Commits are signed with a Signed-off-by trailer.

Breaking changes

None. match_claims and labels default empty, so existing configs route exactly as before.