docs(adr): OpenID Provider architecture #404

Why

Seamless Auth is only an OIDC client today. Becoming a provider is the largest single unlock: any app that speaks OIDC can use it without a Seamless SDK.

What

• Decide on building on node-oidc-provider (OpenID Certified, Node and TypeScript) versus writing our own
• How it shares sessions, users, passkeys, step-up and audit with the existing API
• Data model for clients, grants and consent; key handling
• Migration and compatibility with the current token contract

Done when

An ADR is merged and the implementation issues reference it.