feat(reui): update ReUI components and documentation

- Added new OIDC configuration options in `.env.example`.
- Expanded documentation in `AGENTS.md` to include OIDC endpoints and admin UI.
- Updated ReUI skill version and component count from 17 to 20 across various documentation files.
- Enhanced `README.md` and other related files to reflect the new component structure and usage guidelines.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/config.ts

@@ -11,6 +11,10 @@ export const configSchema = z.object({
   jwtTtlHours: z.coerce.number().positive().default(1),
   refreshTtlDays: z.coerce.number().positive().default(14),
   issuer: z.string().url().default('https://auth.shnt.top'),
+  /** OIDC issuer URL; defaults to `issuer`. */
+  oidcIssuer: z.string().url().optional(),
+  /** Optional PEM PKCS8 RSA private key; otherwise auto-generated & persisted. */
+  oidcRsaPrivateKey: z.string().optional(),
   adminEmail: z.string().email().default('admin@shnt.top'),
   adminPassword: z.string().default('admin'),
   adminName: z.string().default('Admin'),
@@ -30,13 +34,16 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): AppConfig {
   const auditIngestSecret =
     env.AUDIT_INGEST_SECRET ??
     (isProd ? undefined : 'dev-audit-ingest-secret')
+  const issuer = env.ISSUER ?? 'https://auth.shnt.top'
 
   return configSchema.parse({
     databaseUrl: env.DATABASE_URL ?? 'sqlite:data/app.db',
     jwtSecret,
     jwtTtlHours: env.JWT_TTL_HOURS ?? 1,
     refreshTtlDays: env.REFRESH_TTL_DAYS ?? 14,
-    issuer: env.ISSUER ?? 'https://auth.shnt.top',
+    issuer,
+    oidcIssuer: env.OIDC_ISSUER || issuer,
+    oidcRsaPrivateKey: env.OIDC_RSA_PRIVATE_KEY || undefined,
     adminEmail: env.ADMIN_EMAIL ?? 'admin@shnt.top',
     adminPassword: env.ADMIN_PASSWORD ?? 'admin',
     adminName: env.ADMIN_NAME ?? 'Admin',
@@ -51,3 +58,7 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): AppConfig {
     auditIngestSecret,
   })
 }
+
+export function oidcIssuerFromConfig(config: AppConfig): string {
+  return (config.oidcIssuer ?? config.issuer).replace(/\/$/, '')
+}