Add oidc-provider-mock dev setup with docker-compose and dotenvy

- docker-compose.yml runs oidc-provider-mock on :9400 with predefined
  alice/bob users carrying preferred_username claims
- .env auto-loaded via dotenvy for zero-config local dev
- index route now redirects unauthenticated users to the login flow
  instead of returning 401

.env.example

@@ -1,9 +1,12 @@
-# Base URL of the OIDC provider (e.g. Keycloak realm URL)
-OIDC_PROVIDER_URL=http://localhost:8080
+# Base URL of the OIDC provider.
+# For local development, `docker-compose up -d` starts oidc-provider-mock
+# at http://localhost:9400 (accepts any client ID/secret).
+# For Keycloak use e.g. https://keycloak.example.com/realms/myrealm
+OIDC_PROVIDER_URL=http://localhost:9400
 
 # OAuth2 client credentials (required)
-OIDC_CLIENT_ID=your-client-id
-OIDC_CLIENT_SECRET=your-client-secret
+OIDC_CLIENT_ID=dev-client
+OIDC_CLIENT_SECRET=dev-secret
 
 # Full callback URL — must match the redirect URI configured at the provider
 OIDC_REDIRECT_URI=http://localhost:3000/auth/callback