OIDC runtime integration checks

The normal CI suite validates the provider's SDK-critical configuration and contract. To run a live issuer smoke test, set these environment variables in a trusted test environment:

• OIDC_TEST_ISSUER: test issuer base URL.
• OIDC_TEST_CLIENT_ID: dedicated test public client ID.
• OIDC_TEST_REDIRECT_URI: exact redirect URI registered for that client.

Then run:

node --test test/oidc-runtime.integration.test.js

The test validates discovery, issuer identity, endpoint origins, public JWKS, and that an Authorization Code + PKCE request reaches a protocol response without a server error. It does not complete a user login or exchange a real code because that requires a controlled test account and credentials. Keep these tests pointed at staging, never production, and do not put client secrets in CI logs.