* fix(oidc): support workload discovery and JWKS negotiation * test(oidc): cover existing Console authorization code flows * test(oidc): cover admin validation and document workload setup