OAuth Discovery: Wo finde ich die OIDC-Configuration?

Die OIDC-Configuration findest du unter:

```
GET https://hhttps.org/.well-known/openid-configuration
```

Der Endpoint liefert alle notwendigen URLs für OAuth 2.0 / OIDC:
- `authorization_endpoint`: `/hhttps/oauth/authorize`
- `token_endpoint`: `/hhttps/oauth/token`
- `userinfo_endpoint`: `/hhttps/oauth/userinfo`
- `jwks_uri`: `/.well-known/jwks.json`
- `issuer`: `https://hhttps.org`

**Authorization-Flow mit PKCE:**

```bash
# 1. User zu Authorization-Endpoint redirecten
GET https://hhttps.org/hhttps/oauth/authorize?
response_type=code
&client_id=DEIN_CLIENT
&redirect_uri=https://deine-site.de/callback
&scope=openid+role
&state=RANDOM_STATE
&code_challenge=PKCE_CHALLENGE
&code_challenge_method=S256

# 2. Callback mit auth_code
# https://deine-site.de/callback?code=AUTH_CODE&state=RANDOM_STATE

# 3. Code gegen Token tauschen (server-side!)
POST https://hhttps.org/hhttps/oauth/token
Content-Type: application/json

{
"grant_type": "authorization_code",
"code": "AUTH_CODE",
"redirect_uri": "https://deine-site.de/callback",
"client_id": "DEIN_CLIENT",
"code_verifier": "PKCE_VERIFIER"
}
```

Das `id_token` enthält dann die Claims: `sub` (pairwise Pseudonym), `role`, `role_label`, `trust_score`.