OpenID Connect discovery document

RFC-compliant discovery endpoint. Mounted at the HTTP origin root (NOT under /api) per OIDC Discovery 1.0 §4.

curl -X GET "https://your-instance/.well-known/openid-configuration"