Serve /auth.md — the Auth.md agent-registration discovery convention (Cloudflare Agent Readiness "Technical Groundwork", 2026-08-07).

Tells an agent acting for a human how to register, get a credential, and call the API — plus WHY an account is worth having (limits, per-user state, tier-gated data, attributable usage).

DELIBERATELY the standard's SELF-CONTAINED branch, not the PRM/AS-metadata branch: WorkOS OAuth is unprovisioned in prod (memory workos_oauth_provisioning_state), so publishing /.well-known/oauth-protected-resource would advertise an authorization server that does not answer — worse than absent, and the scanner would fail it anyway. The file says so in as many words so an agent does not probe for it. When WorkOS is provisioned, ADD the PRM + AS documents and an agent_auth block; do not retrofit them here first.

Served from static/ like llms.txt so the content is reviewable as a file.