config: OIDCConfig — YAML + env overlay with defaults

internal/server/config/config.go

@@ -30,7 +30,9 @@ type Config struct {
 	// Defaults to true. Set RM_COOKIE_SECURE=false only for local HTTP
 	// testing — production deployments are always behind a TLS proxy
 	// and the cookie must be Secure.
-	CookieSecure bool `yaml:"cookie_secure"`
+	CookieSecure bool        `yaml:"cookie_secure"`
+	OIDCRaw      *OIDCConfig `yaml:"oidc"`
+	OIDC         *OIDCConfig `yaml:"-"`
 }
 
 // Load resolves config in this order:
@@ -91,6 +93,16 @@ func Load(yamlPath string) (Config, error) {
 		}
 	}
 
+	var rawOIDC OIDCConfig
+	if c.OIDCRaw != nil {
+		rawOIDC = *c.OIDCRaw
+	}
+	oidc, err := loadOIDC(envSnapshot(), rawOIDC)
+	if err != nil {
+		return c, err
+	}
+	c.OIDC = oidc
+
 	return c, c.validate()
 }