Fix: OAuth / OIDC discovery

Lets agents programmatically discover how to authenticate against your APIs. Serve at /.well-known/openid-configuration (OpenID Connect) or /.well-known/oauth-authorization-server (plain OAuth 2.0).

This is one of the agent capability signals shown for reference. It doesn’t affect your Agent Access Grade. It only applies if your site exposes a protected API; a plain marketing or content site has no reason to publish this.

{
  "issuer": "https://yourdomain.com",
  "authorization_endpoint": "https://yourdomain.com/oauth/authorize",
  "token_endpoint": "https://yourdomain.com/oauth/token",
  "jwks_uri": "https://yourdomain.com/.well-known/jwks.json",
  "grant_types_supported": ["authorization_code", "client_credentials"]
}