Bluesky OAuth client metadata

Bluesky OAuth requires public client metadata and JWKS URLs served from your deployment.

Automatic routes (goals.ac) When `NEXTAUTH_URL` is set, goals.ac serves:

• `{NEXTAUTH_URL}/oauth/bluesky-client-metadata.json`
• `{NEXTAUTH_URL}/oauth/bluesky-jwks.json`

Signing key (production) Generate an RSA key and set: ``` BLUESKY_OAUTH_PRIVATE_KEY_JWK={"kty":"RSA",...} BLUESKY_CLIENT_NAME=goals.ac

Or paste the JWK in `/admin/integrations` → Social → Bluesky (env wins if both are set). NEXTAUTH_URL=https://app.goals.ac ```

Without a private JWK (env or Admin Integrations → Bluesky), OAuth client init fails, there is no temporary key fallback.

Redirect URI `{NEXTAUTH_URL}/api/auth/bluesky/callback`

Local development Use a tunnel (ngrok, Cloudflare Tunnel) so Bluesky can reach your metadata URLs, or test OAuth only on a deployed staging environment.