Query pipeline

Execute a RAG query against a specific pipeline.

When the server is configured with identity.enabled, this endpoint requires a caller identity, supplied by the trusted proxy in front of the server as a JSON claim set in the configured claims header (default X-Forwarded-Claims) or a bare subject in the configured subject header (default X-Forwarded-User). The server does NOT verify those headers: it checks no signature, issuer, audience or expiry, and trusts whatever the proxy asserts. Anything able to reach this server's port directly can therefore assert any identity, so the deployment must ensure only a trusted proxy can — see docs/identity.md. Retrieval then runs as that caller and PostgreSQL row-level security decides what it may see. A request carrying no identity is refused with 401 IDENTITY_REQUIRED; there is no fallback to the service's own database role.

Identity error codes: IDENTITY_REQUIRED (401, no identity was presented), IDENTITY_MALFORMED (400, the claims header was not a JSON object), IDENTITY_UNTRUSTED_PEER (403, the request came from an address not permitted to assert an identity) and IDENTITY_ROLE_NOT_ALLOWED (403, the claims named a database role that is not on the server's allowlist).