Get the OpenID Connect discovery document

Turns this authorization server into an OpenID provider as far as a relying party is concerned — the control an OpenAI ChatGPT Business or Enterprise admin needs to restrict a connector to their own domain. It restates /.well-known/oauth-authorization-server rather than configuring a second server: same issuer, endpoints, openid/email-inclusive scope catalog and S256-only PKCE rule, so a client reading either document reaches the same server. Public, unauthenticated, CORS-open and cached for one hour on the same terms as the other two .well-known documents.

Deliberately missing two members OIDC Discovery marks REQUIRED: jwks_uri and id_token_signing_alg_values_supported. Both describe how to verify an ID token, and this server issues none — identity is read from GET/POST /oauth/userinfo instead, which OpenAI's own documentation names as the mandatory half (the ID token is the alternative). An absent member fails honestly; a present and false one would not. subject_types_supported: ["public"] matches what /oauth/userinfo actually returns: the same subject to every client, never a pairwise identifier.