Harden OIDC + auth config diagnostics endpoint (#6)

Request openid email profile, use client_secret_post, surface OIDC
errors on /login, and expose a no-auth diagnostics endpoint so operators
can verify the running container sees AUTH_OIDC_* and the callback URL.

Co-authored-by: Cursor Agent <[email protected]>

src/app/api/v1/auth/config/route.ts

@@ -0,0 +1,30 @@
+import { jsonOk } from "@/lib/api/errors";
+import { isOidcConfigured } from "@/lib/auth/oidc";
+
+/**
+ * Public auth diagnostics (no secrets).
+ * Useful to verify the running container sees OIDC env vars.
+ */
+export async function GET() {
+  const authUrl = (process.env.AUTH_URL || "").replace(/\/$/, "");
+  const oidcEnabled = isOidcConfigured();
+
+  return jsonOk({
+    oidcEnabled,
+    oidcName: process.env.AUTH_OIDC_NAME || "SSO",
+    issuer: process.env.AUTH_OIDC_ISSUER || null,
+    clientIdSet: Boolean(process.env.AUTH_OIDC_CLIENT_ID?.trim()),
+    clientSecretSet: Boolean(process.env.AUTH_OIDC_CLIENT_SECRET?.trim()),
+    authUrl: authUrl || null,
+    authSecretSet: Boolean(
+      process.env.AUTH_SECRET?.trim() &&
+        process.env.AUTH_SECRET !== "change-me-to-a-long-random-string"
+    ),
+    callbackUrl: authUrl
+      ? `${authUrl}/api/auth/callback/oidc`
+      : "/api/auth/callback/oidc",
+    hint: oidcEnabled
+      ? "OIDC looks configured. Register callbackUrl exactly in your IdP."
+      : "Set AUTH_OIDC_ISSUER, AUTH_OIDC_CLIENT_ID, and AUTH_OIDC_CLIENT_SECRET, then restart.",
+  });
+}