fix(auth): harden OIDC flow, token validation, session, and bearer handling

- replay entry covers exp + clock-skew window; callback GET-only (RFC 6749)
- callback rate-limit returns 429 + Retry-After; panic-recovery sets no-store
- cross-chunk integrity for chunked tokens; bounded chunked-token read scan
- HTTPError classification so 5xx/429 token-endpoint responses retry
- redaction of token/code/state in logs; per-source external auth gate

metadata_cache.go

@@ -147,11 +147,13 @@ func (mc *MetadataCache) GetProviderMetadata(ctx context.Context, providerURL st
 	}
 
 	// Require the core endpoints. An incomplete discovery document (missing
-	// authorization_endpoint / token_endpoint) would otherwise be accepted,
-	// cached, and adopted as the working auth/token URL, failing at runtime
-	// (wrong authorize redirect, token-exchange failure) instead of at startup.
-	if metadata.AuthURL == "" || metadata.TokenURL == "" {
-		return nil, fmt.Errorf("discovery document missing required endpoints (authorization_endpoint or token_endpoint)")
+	// authorization_endpoint / token_endpoint / jwks_uri) would otherwise be
+	// accepted, cached, and adopted as the working auth/token/JWKS URL, failing
+	// at runtime (wrong authorize redirect, token-exchange failure, or signature
+	// verification failure — jwksURL has no non-discovery source) instead of at
+	// startup.
+	if metadata.AuthURL == "" || metadata.TokenURL == "" || metadata.JWKSURL == "" {
+		return nil, fmt.Errorf("discovery document missing required endpoints (authorization_endpoint, token_endpoint or jwks_uri)")
 	}
 
 	// Pin the advertised issuer to the configured provider host. The issuer is