Add authentication

server/src/main/resources/application.conf

@@ -16,3 +16,16 @@ database {
     password = "recipe"
     password = ${?DATABASE_PASSWORD}
 }
+
+oidc {
+    # Authentik OIDC issuer (trailing slash required — see Constants.OIDC_ISSUER / D-11).
+    issuer = "https://auth.ulfrx.dev/application/o/recipe-app/"
+    issuer = ${?OIDC_ISSUER}
+    # Audience pinned to client_id per D-07.
+    audience = "recipe-app"
+    audience = ${?OIDC_AUDIENCE}
+    # Optional override; if blank, AuthConfig.fromApplicationConfig derives `${issuer}jwks/`.
+    jwksUrl = "https://auth.ulfrx.dev/application/o/recipe-app/jwks/"
+    jwksUrl = ${?OIDC_JWKS_URL}
+    leewaySeconds = "30"
+}