Security model for the ContentGrid appserver: gateway-minted JWT transcription and OPA sidecar authorization