feat: multi-issuer OIDC support with config consolidation

- Support multiple OAuth providers (core-api, tatlock-ui, tatlock)
- Changed oidc_issuer (string) to oidc_issuers (list)
- Per-issuer JWKS caching
- Validates token issuer against allowed list
- Consolidated config files (removed deprecated src/config.py, src/security.py)
- Updated imports to use src/shared/config and src/shared/security

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/shared/config.py

@@ -90,8 +90,13 @@ class Settings(BaseSettings):
 
     # OIDC Authentication (Authentik)
     oidc_enabled: bool = False
-    oidc_issuer: str = "https://auth.schweitz.net/application/o/core-api/"
-    # Accept tokens from multiple clients (core-api, tatlock-ui, tatlock)
+    # Accept tokens from multiple OAuth providers (each has its own issuer/JWKS)
+    oidc_issuers: list[str] = [
+        "https://auth.schweitz.net/application/o/core-api/",
+        "https://auth.schweitz.net/application/o/tatlock-ui/",
+        "https://auth.schweitz.net/application/o/tatlock/",
+    ]
+    # Accept tokens from multiple clients
     oidc_audiences: list[str] = ["core-api", "tatlock-ui", "tatlock"]
 
     # Authentik API (for token validation and user management)

src/shared/security.py

@@ -23,17 +23,17 @@ def initialize_oidc(settings: Settings) -> None:
 
     auth_oidc_config.configure(
         enabled=settings.oidc_enabled,
-        issuer=settings.oidc_issuer,
+        issuers=settings.oidc_issuers,
         audiences=settings.oidc_audiences
     )
 
     domains_oidc_config.configure(
         enabled=settings.oidc_enabled,
-        issuer=settings.oidc_issuer,
+        issuers=settings.oidc_issuers,
         audiences=settings.oidc_audiences
     )
 
     if settings.oidc_enabled:
-        logger.info(f"OIDC authentication enabled (issuer: {settings.oidc_issuer})")
+        logger.info(f"OIDC authentication enabled (issuers: {settings.oidc_issuers})")
     else:
         logger.info("OIDC authentication disabled - API is publicly accessible")