OIDC auth: interactive authorization-code login for humans and JWT-bearer validation for machine-to-machine callers. Both modes share the same discovery/JWKS cache and claims-to-policies mapping — the only difference is where the JWT to verify comes from (a token-endpoint response vs. handed to us directly).