Check OIDC sign-in against the real IdP (https JWKS path) #113

#95 was tested with a local RSA key and a file:// JWKS, because the CI and workspace have no network. The https:// key fetch, PyJWT's PyJWKClient, isn't exercised by any test.

Run one sign-in against the deployment's real IdP (Keycloak or Entra ID):

1. Set OIDC_ISSUER, OIDC_AUDIENCE and OIDC_JWKS_URL (https).
2. Obtain an ID token for a user who is a member of a tenant.
3. POST it to /api/auth/oidc and confirm the response is 200 with the right role.

Needs access to the IdP.

Generated by Claude Code