Add local-identity serve command: a minimal Authorization Code flow OIDC
server backed by file-store users. Implemented natively with no heavy
OIDC library — only stdlib http.server and the cryptography package.
New modules:
keys.py RSA-2048 signing key generation + JWKS helpers
tls.py Self-signed TLS certificate (localhost/127.0.0.1 SANs)
jwt_utils.py RS256 JWT creation and verification
serve.py OIDCHandler + make_handler() factory + run_server()
Endpoints: /.well-known/openid-configuration, /jwks, /auth, /token,
/userinfo. Server binds to 127.0.0.1 only; tokens carry iss: local-identity
which production Keycloak rejects by design.
104 tests passing (16 new for Stage 3).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Resolves the system identity mismatch between the Linux username (worsch)
and the bootstrap identity (tegwick / Bernd Worsch / custom email).
Resolution order for all three fields: flag > config > system derivation.
Config is updated on every init so --force reinits are idempotent without
repeating the flags.
- cli.py: extract _resolve_init_params(); add --username / --fullname args;
persist all three fields to config.yaml on init
- tests/test_cli.py: 13 new tests covering flag priority, config fallback,
system derivation, config persistence, idempotent --force reinit
54 tests passing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
