- docker-compose.yml runs oidc-provider-mock on :9400 with predefined
alice/bob users carrying preferred_username claims
- .env auto-loaded via dotenvy for zero-config local dev
- index route now redirects unauthenticated users to the login flow
instead of returning 401