Assured local identity service

This is a labelled local substitute for the production managed issuer. It signs in invited demo users with password + authenticator-app TOTP and issues OAuth tokens for the web application and the read-only MCP client.

Endpoints: /.well-known/openid-configuration, /oauth/authorize, /api/v1/me.