Plugin Auth Token

Issue a short-lived, audience-scoped plugin session claim.

The claim contains {user_id, user_role, plugin, exp}. It does NOT contain the caller's litellm bearer token — a compromised plugin can only learn the caller's identity, not impersonate them against the proxy.

Encrypted with a key derived from HMAC(LITELLM_SALT_KEY, plugin_name), so each plugin holds only its own key and cannot forge claims for others.

Requires LITELLM_SALT_KEY to be set; returns 503 otherwise.