- DefaultOptions().Resource is empty; comments name the host application,
no consuming application (folded todo)
- Tests set an explicit neutral resource; TestDefaultOptionsResourceEmpty
- wristband README: new summary, two flavours, OIDC usage, API reference,
OIDC defaults, dependencies, testing; root README row matches
- docs/services/oauth-server.md: OpenID Connect provider section;
Resource described as required with an empty default
- ExampleNewOIDCServer and the newOIDCServer docs region
- NewOIDCServer/SetOIDCBackend build a second Server on the same engine;
Authorize and Token dispatch by flavour, Metadata/Register 404 on OIDC
- OIDCBackend/OIDCTx, KeyStore and OIDCHost seams; MCP Backend untouched
- Discovery (PHP field order), JWKS (stdlib JWK encoding), authorize with
resume and one-shot consent token, token with an RS256 id_token signed
through golang-jwt map claims, userinfo
- TestOIDCTracerSmoke verifies the id_token against the served JWKS
