Update docs: Authentik OIDC setup is complete and verified

Reflects tonight's work: scripts/authentik-setup.sh actually run for
the first time (three bugs found/fixed), OIDC login and client
self-registration verified end-to-end on both dev and prod. Closes
the loop on issues #10/#12/#17.

docs/BACKLOG-2026-07-16.md

@@ -13,24 +13,29 @@ git.jerodrigged.com/user/settings/applications with `read:user`, `write:issue`,
 `write:repository` and set it as `GITEA_TOKEN` (user env var) on this machine.
 
 ### B2. Production (CT111) api/.env is a blank template
-The GitHub deploy now auto-creates `api/.env` from `.env.example`, which is why the
-new stack runs — but every secret is empty. Until real values are set on CT111 at
-`/opt/lisilou-portfolio/api/.env`:
+Prod moved off the GitHub deploy path this session (see B4) — `api/.env` now
+lives on CT111 and is deployed to via `git push origin main:prod`, no longer
+auto-templated by GitHub Actions.
+
+**Update 2026-07-20:** `OIDC_*` and `SESSION_SECRET` are now filled in and
+verified working (see #12/#17). Still outstanding:
 - admin dashboard login is disabled (no `ADMIN_SECRET`)
 - **new bookings send no n8n notification — real clients could book silently**
 - calendar availability shows all dates free (no Google creds)
-- SSO/client portal sign-in is inactive (no `OIDC_*` / `SESSION_SECRET`)
-Copy working values from CT114:`/opt/…/api/.env` (adjust `SITE_URL` / `CORS_ORIGIN`
-to https://lisilou.jerodrigged.com), then `docker compose restart api`.
+- `SITE_URL` still points at CT114's LAN IP (`192.168.1.192:8080`) instead of
+  `https://lisilou.jerodrigged.com`; `CORS_ORIGIN` is still `localhost:8080`
+Deliberately left alone tonight — these need real values from Jerod (an n8n
+webhook URL, Google service account, a chosen admin passphrase), not something
+to fill with placeholders. `docker compose up -d api` (not `restart` — it
+doesn't reload `env_file` changes) after editing.
 
-### B3. Authentik provider + groups (issues #10/#12)
-Code for OIDC login and the client portal is deployed and tested, but Authentik
-needs one-time admin setup (see header comment in `api/auth.js`):
-1. OAuth2/OpenID provider (confidential; redirect URIs for both dev and prod
-   `/api/auth/callback`), application "LisiLou Portfolio"
-2. `lisilou-admin` group with Elysse (grants dashboard access)
-3. Enrollment flow for client self-registration (#12) — Authentik-side config only
-4. Fill `OIDC_*` + `SESSION_SECRET` in both instances' `api/.env`
+### ~~B3. Authentik provider + groups (issues #10/#12)~~ RESOLVED 2026-07-20
+`scripts/authentik-setup.sh` was run for real against auth.jerodrigged.com (it
+never had been before). Three bugs found and fixed along the way — see the
+closing comments on #12 and #17 for the full writeup. Provider, application,
+`lisilou-admin` group, and the client enrollment flow are all live; `api/.env`
+is filled on both dev and prod; verified end-to-end via a real authorization-
+code+PKCE round trip on both hosts.
 
 ### B4. Decide the deploy topology (dev vs prod)
 Discovered overnight: `lisilou.jerodrigged.com` → NPM (CT102) → **CT111**, deployed