[phoenixy1]

Two bugs and some wrong security guidance:

• force_refresh_token never took effect. oidcClientSchema didn't declare it, so Zod stripped it while parsing client config, and the force-refresh client set was always empty. The schema now accepts it.
• The token inspector's JWKS link was a 404. It used /.well-known/jwks.json, but oidc-provider serves the key set at /jwks, which the API already uses.
• The docs said that without JWKS, oidc-provider generates ephemeral keys that rotate on restart. In fact it falls back to a static development key whose private half ships in the npm package (lib/consts/dev_keystore.js), so the real production risk is forged tokens, not token invalidation. The README, CLAUDE.md, env examples, and log messages now say so.

Also:

• adds COOKIE_SECRET to apps/auth/.env.example
• fixes the Option B Caddyfile example, which collapsed all three sites onto one bare :8443
• corrects the security.yml description (it runs a dependency audit and CodeQL, with no container scanning)
• notes that login is already rate-limited
• corrects the shared package's dependency list

🤖 Generated with Claude Code