Renamed OIDC permissions claim to more commonly used groups. Move jwtk to a more convenient location. Draft admin app OIDC client configuratioon.

oidc.md

@@ -11,7 +11,7 @@ OpenID Connect 1.0 provider enabling third-party apps to authenticate users via
 - `secret` → `hash_secret("session", secret)` → DB lookup
 - OIDC `sid` → `base64url.encode(hash_secret("oidc", session.key))`
 
-**OIDClient** — `uuid, client_secret_hash, name, redirect_uris, created_at`
+**OIDClient** — `uuid, client_secret_hash, name, redirect_uris`
 
 ## Auth Codes (In-Memory Only)
 
@@ -45,7 +45,7 @@ Usage: `code = authcode.store(AuthCode(...))` → later `codes.pop(code, None)`
 
 **Token:** `access_token, id_token, refresh_token={secret}, expires_in=3600`
 
-**ID token:** `sub, sid (base64url), name, preferred_username, email, permissions`
+**ID token:** `sub, sid (base64url), name, preferred_username, email, groups`
 
 ### Native (Cookie)
 
@@ -73,7 +73,7 @@ Discovery: `backchannel_logout_supported: true`
 ## Endpoints
 
 - `GET /.well-known/openid-configuration` — Discovery
-- `GET /.well-known/jwks.json` — Keys (EdDSA)
+- `GET /auth/oidc/keys` — Keys (EdDSA)
 - `POST /auth/oidc/token` — Exchange/refresh
 - `GET /auth/oidc/userinfo` — User (bearer token)
 - `POST /auth/oidc/backchannel-logout` — Logout