[Bccorb]

Closes #114 once these are live.

Adds a generic guide for connecting an app to the OpenID Provider, and guides for Grafana, Auth.js, Spring Security and oauth2-proxy. openid-provider.mdx links to them. oauth2-proxy was chosen because it works in front of any HTTP app and documents S256 PKCE and a private CA; other proxies were not run for comparison.

What was run

Every guide was run end to end locally against released API v0.22.0 and edge v0.3.0, using Playwright's Chromium and a virtual authenticator. Each sign-in test registered a new user, signed in with the passkey from a clean browser, and confirmed the app showed that user.

Guide	Version tested	Client auth	Also confirmed
Generic	openid-client 6.8.9, Node 24	private_key_jwt, client_secret_post	nonce, UserInfo, refresh rotation, sign-out
Grafana	13.3.0	client_secret_basic	roles mapped to Editor through Grafana's API, validate_id_token, sign-out
Auth.js	next-auth 5.0.0-beta.32, @auth/core 0.41.3, Next 16.4.5	client_secret_basic, private_key_jwt	HTTPS through Caddy; signOut() is local only
Spring Security	Boot 4.1.2, Security 7.1.2, Java 21	client_secret_basic, private_key_jwt	RP-initiated logout, truststore copy for the CA
oauth2-proxy	7.15.5	client_secret_basic	PKCE, nonce, roles as groups, upstream headers, sign-out, 403 without the allowed role

The test stack differed from the local recipe in three ways, all stated in the generic guide: the published API v0.22.0 image instead of a source build, the client link step skipped (those routes arrive in v0.23.0), and flow_rate_limits.otp.perIp raised so repeated test sign-ups were not refused. No guide needs API v0.23.0.

Not tested

• Every guide: a browser that trusts the CA normally, a real authenticator, a publicly trusted certificate, production, or any API other than v0.22.0.
• Registration: the CLI and dashboard; the admin routes were used.
• Grafana: HTTPS, use_refresh_token.
• Auth.js: next-auth 4 (npm latest), @auth/express, next dev, ending the Seamless session on sign-out.
• Spring: HTTPS or behind a proxy, WebFlux, mapping roles to authorities, older versions.
• oauth2-proxy: HTTPS with secure cookies, behind another proxy, session refresh.

Some snippets are trimmed from what ran and were not rerun in trimmed form: the generic app, the Auth.js page and the Spring controller. The oauth2-proxy command uses my-upstream in place of the test upstream's name.

Findings not fixed here

• The provider has no profile scope and no name, preferred_username, picture or groups claim, and drops profile silently. Every app mapped from email, sub or roles.
• openid-provider.mdx still pins edge v0.1.1 for API 0.21.x, calls v0.2.0 latest, and lists profile and address scopes discovery does not offer.
• npm run check:matrix reports 6 drifted packages, from ecosystem.mdx, which this does not touch.

Lint, typecheck and build pass. There is no link checker in CI; internal links and anchors on the new pages were checked once with a script, and external pages returned 200.