Module oidc 

OIDC validation: discovery URL → JWKS → signature + claim checks.

On the first request that arrives in OIDC mode, OidcValidator:

1. Decodes the JWT header (no signature check) to extract alg + kid.
2. Looks up the signing key in its in-memory JWKS cache. On cache miss (cold or unknown kid — key rotation), fetches the provider’s discovery document, follows jwks_uri, and rebuilds the cache. The cache TTL respects Cache-Control: max-age=N from the discovery response, falling back to 1 hour if absent.
3. Validates the signature + aud + exp via the jsonwebtoken crate.
4. Extracts the configured tenant claim (default solo_tenant), validates it through TenantId::new, and packages everything into an AuthenticatedPrincipal.

Failure modes (mapped to HTTP status in middleware.rs):

• Missing/malformed Authorization header → 401 (AuthError::MissingAuthHeader / AuthError::MalformedAuthHeader).
• Token rejected (bad signature, expired, wrong audience, unknown kid post-refetch) → 401 (AuthError::InvalidOidcToken).
• Token valid but tenant claim missing/invalid → 403 (AuthError::MissingTenantClaim / AuthError::InvalidTenantClaim).
• Upstream IdP unreachable → 500 (AuthError::Discovery / AuthError::Jwks).

Structs

OidcConfig

Per-instance configuration for an OIDC validator. Mirrors the AuthConfig::Oidc { ... } variant in auth/mod.rs.

OidcValidator

OIDC validator. Cheap-to-clone (one Arc<RwLock<…>> for the JWKS cache; everything else is small).