Metadata alias

The same document as /.well-known/oauth-authorization-server. This server is not an OpenID Provider — there is no openid scope and no id_token — but clients of different vintages probe one path or the other, and a missing metadata document presents to the customer as "connection failed" with nothing in any log. Two routes is cheaper than that support ticket.