Merged in feature/service-accounts-1 (pull request #227)

Support for service accounts with static credentials

* feature complete

* tests and docs

* lint fix

docs/ai.generated/README.md

@@ -87,6 +87,12 @@ The diagram below shows the full API layer architecture — from HTTP endpoints
     - Cascade deletion behavior (no special steps needed)
     - Permit.io deployment note
 
+**[File Validity Checks](file.filters.md)**
+   - PDF-specific validation (signature, structure, per-page size, dimensions, DPI) and SHA-256 deduplication
+   - Per-format checks for DOCX, XLSX, PPTX, TIFF, JPEG, PNG, BMP, TXT, EML
+   - Common pre-pipeline checks (extension allowlist, ZIP-archive limits, OLE2-encryption sniff)
+   - Failure-reason catalog (`InvalidDocumentReason`)
+
 12. **[Chatbot Guide](12-chatbot-guide.md)**
     - Overview: queryAPI's facade over the Aaria FastAPI agent service
     - Architecture: `bot_*` data model, AddTurn tx1+FastAPI+tx2 flow, state stripping
@@ -96,6 +102,12 @@ The diagram below shows the full API layer architecture — from HTTP endpoints
     - Rate-limit overrides: M6 behavior change and Echo `:param` template form
     - Known warts and tradeoffs (CHECK guard, error chaining, label-record divergence, etc.)
 
+13. **[Two-Pool Service Accounts](13-two-pool-service-accounts.md)**
+    - Multi-issuer JWT validation (pool A + pool B) and `auth_source` tagging
+    - `COGNITO_SVC_USER_POOL_ID` / `COGNITO_SVC_JWKS_URL` / `COGNITO_SVC_APP_CLIENT_ID` configuration
+    - Service-account lifecycle CLI (`cmd/auth_related/service.account.tool`)
+    - Caller flow: `InitiateAuth` + bearer JWT, revocation strategy
+
 ## Quick Start
 
 ### For New Developers