Central authoritative identity server. Phase 0 scaffold — auth, the OIDC provider, and the admin panel are on the way.