Add docs/auth.md and update documentation cross-references

- Create docs/auth.md covering OIDC architecture, login flow, configuration,
  local development setup, and LogTo provider guide
- Remove direnv-specific quoting note from .env.example
- Clarify OIDC_DISCOVERY_URL auto-appends .well-known/openid-configuration
- Fix admin route references from /a/ to /admin/
- Add auth.md links to README.md and AGENTS.md doc lists
- Add docs/auth.md to AGENTS.md documentation sync rule

.env.example

@@ -23,12 +23,6 @@
 #
 # Serial ports are typically /dev/ttyUSB[0-9] or /dev/ttyACM[0-9] on Linux.
 # -----------------------------------------------------------------------------
-# NOTE: If using direnv, values with spaces MUST be quoted:
-#   OIDC_SCOPES="openid email profile"
-# The application strips surrounding quotes automatically. Do NOT use
-# quotes for values loaded via Docker Compose map syntax:
-#   environment:
-#     OIDC_SCOPES: openid email profile
 # -----------------------------------------------------------------------------
 
 # =============================================================================
@@ -359,7 +353,7 @@ WEB_PORT=8080
 # OIDC client secret (from your IdP)
 # OIDC_CLIENT_SECRET=
 
-# OIDC discovery URL (your IdP's .well-known/openid-configuration endpoint)
+# OIDC discovery base URL (.well-known/openid-configuration is appended automatically)
 # OIDC_DISCOVERY_URL=
 
 # OIDC callback URL (overrides auto-derivation from request)