feat(19.4-01): neutral wristband resource default and OIDC provider docs

- DefaultOptions().Resource is empty; comments name the host application,
  no consuming application (folded todo)
- Tests set an explicit neutral resource; TestDefaultOptionsResourceEmpty
- wristband README: new summary, two flavours, OIDC usage, API reference,
  OIDC defaults, dependencies, testing; root README row matches
- docs/services/oauth-server.md: OpenID Connect provider section;
  Resource described as required with an empty default
- ExampleNewOIDCServer and the newOIDCServer docs region

modules/wristband/example_test.go

@@ -82,3 +82,40 @@ func ExampleIssueClientCredentials() {
 	// true true true <nil>
 	// true true <nil>
 }
+
+// newOIDCServer builds the OpenID Connect provider of an application served
+// at https://id.example.com. The host application supplies storage, the
+// signing-key ring and its pages; SetOIDCBackend refuses a nil one.
+func newOIDCServer(backend wristband.OIDCBackend, keys wristband.KeyStore, host wristband.OIDCHost) (*wristband.Server, error) {
+	opts := wristband.DefaultOptions()
+	opts.Issuer = "https://id.example.com"
+
+	oidc := wristband.DefaultOIDCOptions()
+	oidc.LoginURL = "/account/login"
+	oidc.RefreshEnabled = true // only clients with OfflineAccess get refresh tokens
+
+	srv := wristband.NewOIDCServer(opts, oidc)
+	if err := srv.SetOIDCBackend(backend, keys, host); err != nil {
+		return nil, err
+	}
+	return srv, nil
+}
+
+func ExampleNewOIDCServer() {
+	// Without storage, keys and a host the server refuses to start.
+	_, err := newOIDCServer(nil, nil, nil)
+	fmt.Println(err)
+
+	// An OIDC server serves discovery instead of the MCP metadata document.
+	srv := wristband.NewOIDCServer(wristband.DefaultOptions(), wristband.DefaultOIDCOptions())
+	rec := httptest.NewRecorder()
+	srv.Metadata(rec, httptest.NewRequest("GET", "/.well-known/oauth-authorization-server", nil))
+	fmt.Println("metadata", rec.Code)
+
+	defaults := wristband.DefaultOIDCOptions()
+	fmt.Println(defaults.ScopesSupported, defaults.CodeTTL, defaults.RefreshEnabled)
+	// Output:
+	// wristband: OIDC backend is nil
+	// metadata 404
+	// [openid profile email] 1m0s false
+}