Update docs: Authentik OIDC setup is complete and verified

Reflects tonight's work: scripts/authentik-setup.sh actually run for
the first time (three bugs found/fixed), OIDC login and client
self-registration verified end-to-end on both dev and prod. Closes
the loop on issues #10/#12/#17.

CLAUDE.md

@@ -195,9 +195,11 @@ local dev (`docker compose up -d` alone still builds from source as before).
 | 7 | Confirm & submit | — | Done — summary + POST /api/bookings |
 
 Also done: n8n webhooks (#8), admin dashboard at `/dashboard` (#11), Authentik OIDC
-login (#10, needs Authentik-side setup), client portal at `/my-bookings` (#13).
+login (#10) and client self-registration enrollment (#12) - both live and verified
+on dev and prod as of 2026-07-20, client portal at `/my-bookings` (#13).
 Auth lives in `api/auth.js` (zero-dep OIDC + HMAC cookie sessions); admin routes
-accept an OIDC admin session or the legacy `ADMIN_SECRET` bearer.
+accept an OIDC admin session or the legacy `ADMIN_SECRET` bearer. One shared
+Authentik provider/application serves both environments - see `scripts/authentik-setup.sh`.
 
 ### Booking JS Functions (in `src/index.html`)