Add _iap_token() that fetches identity token from GCP metadata server
using IAP client ID as audience. Update _opax_get and _opax_post to
send Authorization: Bearer <token> header on all calls to opax.vauco.no.
Fixes 401 Unauthorized from IAP-protected opax.vauco.no backend.
Related: LEARNING-013
