Harden OIDC login and add public /api/v1/auth/config

Request openid email profile, use client_secret_post, surface OIDC
errors on /login, and expose a no-auth diagnostics endpoint so operators
can verify the running container sees AUTH_OIDC_* and the callback URL.

README.md

@@ -39,28 +39,38 @@ Open http://localhost:3000 and sign in.
 
 ### Enabling OIDC
 
-1. In your IdP, create a **confidential** OIDC application.
-2. Set the redirect / callback URI to:
+1. **Pull latest and rebuild** (OIDC button detection changed recently):
+   ```bash
+   git pull
+   docker compose up -d --build
+   ```
+2. In your IdP, create a **confidential** OIDC application.
+3. Set the redirect / callback URI to **exactly**:
    ```
    {AUTH_URL}/api/auth/callback/oidc
    ```
-   Example: `http://localhost:3000/api/auth/callback/oidc`
-3. Put these in `.env` (Docker Compose reads `.env` automatically):
+   Example: `https://rfid.atlashorizon.net/api/auth/callback/oidc`
+4. Put these in `.env`:
    ```bash
-   AUTH_URL=http://localhost:3000
+   AUTH_URL=https://rfid.atlashorizon.net
    AUTH_SECRET=...long random...
-   AUTH_OIDC_ISSUER=https://sso.example.com/application/o/rfid/
-   AUTH_OIDC_CLIENT_ID=...
+   AUTH_OIDC_ISSUER=https://auth.atlashorizon.net
+   AUTH_OIDC_CLIENT_ID=rfiddb
    AUTH_OIDC_CLIENT_SECRET=...
-   AUTH_OIDC_NAME=Authentik
+   AUTH_OIDC_NAME=AtlasHorizon
    ```
-4. Restart the app (`docker compose up -d` or restart `npm run dev`).
-5. Open `/login` — you should see **Sign in with Authentik** (or your `AUTH_OIDC_NAME`).
+5. Restart, then verify the running app sees config (no secrets returned):
+   ```bash
+   curl -s https://rfid.atlashorizon.net/api/v1/auth/config | jq
+   ```
+   You want `"oidcEnabled": true` and `"callbackUrl"` matching your IdP.
+6. Open `/login` — you should see **Sign in with AtlasHorizon**.
 
 Notes:
-- `AUTH_OIDC_ISSUER` must be exactly the issuer value from discovery (trailing slash matters for some IdPs).
-- The IdP must return an **email** claim; accounts are created/linked by email.
+- `AUTH_OIDC_ISSUER` must match discovery (`{issuer}/.well-known/openid-configuration`). Your AtlasHorizon issuer at `https://auth.atlashorizon.net` is valid.
+- The IdP must return an **email** claim (we request `openid email profile`).
 - Local password login stays available alongside SSO.
+- If the button is missing, you are almost certainly on an old image — rebuild.
 
 ## REST API (`/api/v1`)