Major feature release transforming ATAuth into a full SSO provider: ## OIDC Provider - OpenID Connect discovery endpoints (/.well-known/*) - Authorization, token, userinfo, revocation endpoints - ES256/RS256 JWT signing with key rotation - PKCE support for public clients ## Authentication Methods - Passkey/WebAuthn support for passwordless login - TOTP MFA with backup codes - Email verification and account recovery ## Admin UI - React + TailwindCSS admin dashboard - Manage legacy apps and OIDC clients - Session management and user administration - Signing key rotation ## Deployment - Multi-stage Docker build with admin UI - Kubernetes manifests with staging/production overlays - Helm chart for flexible deployment - Gitea Actions and Tekton CI/CD pipelines - Database backup CronJob - Safe deployment runbook ## Backward Compatibility - Legacy HMAC token flow unchanged - Existing /auth/* routes preserved - New features are additive (new tables only)