DUST AuthD
The DUST account service — organizations, users, sessions, Service Accounts and OpenID Connect. Issues the short-lived JWTs the DUST API consumes, via an API-key exchange (GET /api/auth/token with x-api-key) or the OAuth2 client_credentials grant. Publishes an OpenID Connect discovery document at /.well-known/openid-configuration with authorization, token, introspection, revocation, userinfo, JWKS and end-session endpoints, and PKCE S256 support.