A zero-config OIDC/OAuth2 provider. Pick an issuer, a client ID, and optionally a subject — same URL always returns the same token.