fix: address PR #814 review + SonarCloud gate

SonarCloud:
- Resolve 6 S5332 hotspots (http→https in test fixture URLs).
- S6418: hoist the unauthenticated AsyncOpenAI placeholder to a named constant
  + NOSONAR (genuine non-secret; gateway ignores it when unauthenticated).
- Fix two reliability bugs: None-index guard in the gateway token-cache test
  (S2259) and float `> 0.0` instead of `!= 0.0` in the sentinel test (S1244).
- status.py idle path sleeps 0.1s instead of sleep(0) (S7491); NOSONAR on the
  protocol-required async no-await aclose() stubs (S7503).

Claude review:
- Remove three leftover debug print() calls in app.py (logger.info already
  covers them).
- payload_backfill: drop parsed_at from the backfilled-keys docstring (it is
  per-document state, not a deployment scalar); add a clean 404 precondition
  for BasicAuth deployments without an OAuth token verifier.
- status.py: task_status typed TaskStatus | None (drop type: ignore).
- nats.py: TODO to thread etags for file/deck/news; note etag default → None.
- factory: warn on unknown INGEST_BUS_URL scheme; raise ValueError instead of
  assert for the external-mode preconditions.
- docs/configuration.md: document the decomposition hook-point env vars + that
  nats-py ships core (lazy-imported) and external+bus uses two NATS connections.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/configuration.md

@@ -750,6 +750,40 @@ docker-compose up
 
 ---
 
+## Decomposition Hook Points (Optional, Advanced)
+
+The server can optionally offload document processing and embeddings to external
+services (the Astrolabe Cloud document-processor and embedding-gateway). These
+are **opt-in**; every default reproduces the in-process monolith behavior, so
+self-hosters can ignore this section.
+
+```bash
+# Embeddings via an OpenAI-compatible gateway (else: autodetect — see above)
+EMBEDDING_PROVIDER=gateway
+EMBEDDING_GATEWAY_URL=https://embedding-gateway.internal
+# Gateway M2M OIDC client (its own realm; leave unset to call it unauthenticated)
+EMBEDDING_GATEWAY_TOKEN_URL=...
+EMBEDDING_GATEWAY_CLIENT_ID=...
+EMBEDDING_GATEWAY_CLIENT_SECRET=...
+
+# External ingest: publish to NATS instead of the in-process processor pool
+INGEST_MODE=external          # local (default) | external
+STATUS_BACKEND=bus            # local (default) | bus — REQUIRED with external
+INGEST_BUS_URL=nats://nats:4222
+TENANT_ID=<uuid>              # NATS per-tenant subject token
+```
+
+Notes:
+- `STATUS_BACKEND=local` with `INGEST_MODE=external` is rejected at startup
+  (the in-process job state is empty for externally-dispatched work).
+- **`nats-py` ships as a core dependency** (small, pure-Python) and is imported
+  lazily — only when `INGEST_MODE=external`. Self-hosters who never enable
+  external ingest pay no runtime cost.
+- `INGEST_MODE=external` + `STATUS_BACKEND=bus` opens **two** NATS connections
+  per pod (the ingest producer and the status subscriber are separate roles).
+
+---
+
 ## Tag-Based File Exclusion (Optional)
 
 Some files (contracts, medical records, credentials, private notes) should