- FEATURES.md: add "Authentication (Local / OpenID Connect)" section + TOC - docs/oidc-auth.md: flow overview, env var reference, fail-closed validation rules, provider setup (Authentik/Keycloak/Authelia/Google), reverse-proxy notes, session/logout caveats, troubleshooting, revert-to-local ha-relevant: no