Update docs: Authentik OIDC setup is complete and verified

Reflects tonight's work: scripts/authentik-setup.sh actually run for
the first time (three bugs found/fixed), OIDC login and client
self-registration verified end-to-end on both dev and prod. Closes
the loop on issues #10/#12/#17.

CLAUDE.md

@@ -195,9 +195,11 @@ local dev (`docker compose up -d` alone still builds from source as before).
 | 7 | Confirm & submit | — | Done — summary + POST /api/bookings |
 
 Also done: n8n webhooks (#8), admin dashboard at `/dashboard` (#11), Authentik OIDC
-login (#10, needs Authentik-side setup), client portal at `/my-bookings` (#13).
+login (#10) and client self-registration enrollment (#12) - both live and verified
+on dev and prod as of 2026-07-20, client portal at `/my-bookings` (#13).
 Auth lives in `api/auth.js` (zero-dep OIDC + HMAC cookie sessions); admin routes
-accept an OIDC admin session or the legacy `ADMIN_SECRET` bearer.
+accept an OIDC admin session or the legacy `ADMIN_SECRET` bearer. One shared
+Authentik provider/application serves both environments - see `scripts/authentik-setup.sh`.
 
 ### Booking JS Functions (in `src/index.html`)
 

docs/BACKLOG-2026-07-16.md

@@ -13,24 +13,29 @@ git.jerodrigged.com/user/settings/applications with `read:user`, `write:issue`,
 `write:repository` and set it as `GITEA_TOKEN` (user env var) on this machine.
 
 ### B2. Production (CT111) api/.env is a blank template
-The GitHub deploy now auto-creates `api/.env` from `.env.example`, which is why the
+Prod moved off the GitHub deploy path this session (see B4) — `api/.env` now
-new stack runs — but every secret is empty. Until real values are set on CT111 at
+lives on CT111 and is deployed to via `git push origin main:prod`, no longer
-`/opt/lisilou-portfolio/api/.env`:
+auto-templated by GitHub Actions.
+
+**Update 2026-07-20:** `OIDC_*` and `SESSION_SECRET` are now filled in and
+verified working (see #12/#17). Still outstanding:
 - admin dashboard login is disabled (no `ADMIN_SECRET`)
 - **new bookings send no n8n notification — real clients could book silently**
 - calendar availability shows all dates free (no Google creds)
-- SSO/client portal sign-in is inactive (no `OIDC_*` / `SESSION_SECRET`)
+- `SITE_URL` still points at CT114's LAN IP (`192.168.1.192:8080`) instead of
-Copy working values from CT114:`/opt/…/api/.env` (adjust `SITE_URL` / `CORS_ORIGIN`
+  `https://lisilou.jerodrigged.com`; `CORS_ORIGIN` is still `localhost:8080`
-to https://lisilou.jerodrigged.com), then `docker compose restart api`.
+Deliberately left alone tonight — these need real values from Jerod (an n8n
+webhook URL, Google service account, a chosen admin passphrase), not something
+to fill with placeholders. `docker compose up -d api` (not `restart` — it
+doesn't reload `env_file` changes) after editing.
 
-### B3. Authentik provider + groups (issues #10/#12)
+### ~~B3. Authentik provider + groups (issues #10/#12)~~ RESOLVED 2026-07-20
-Code for OIDC login and the client portal is deployed and tested, but Authentik
+`scripts/authentik-setup.sh` was run for real against auth.jerodrigged.com (it
-needs one-time admin setup (see header comment in `api/auth.js`):
+never had been before). Three bugs found and fixed along the way — see the
-1. OAuth2/OpenID provider (confidential; redirect URIs for both dev and prod
+closing comments on #12 and #17 for the full writeup. Provider, application,
-   `/api/auth/callback`), application "LisiLou Portfolio"
+`lisilou-admin` group, and the client enrollment flow are all live; `api/.env`
-2. `lisilou-admin` group with Elysse (grants dashboard access)
+is filled on both dev and prod; verified end-to-end via a real authorization-
-3. Enrollment flow for client self-registration (#12) — Authentik-side config only
+code+PKCE round trip on both hosts.
-4. Fill `OIDC_*` + `SESSION_SECRET` in both instances' `api/.env`
 
 ### B4. Decide the deploy topology (dev vs prod)
 Discovered overnight: `lisilou.jerodrigged.com` → NPM (CT102) → **CT111**, deployed