docs: document full and embedded rendering with server authentication

docs/install/authentication-oidc.md

@@ -1,10 +1,20 @@
 # Generic OIDC authentication
 
+Use this guide for **ThothII's own login**, normally `shell.mode: full` on an
+autonomous server. It is not the integration procedure for an already logged-in
+Omics user. That deployment uses [embedded/upstream](authentication-upstream.md),
+even when Omics's identity provider is Authentik.
+
 OIDC mode supports a standards-based provider. The browser flow is generic: Authorization Code,
 PKCE S256, state, nonce, issuer/signature/audience/expiry validation, and the fixed callback
 `<publicUrl>/api/auth/oidc/callback`. The browser and API must use the same origin; configure the
 reverse proxy to preserve that public origin and callback path.
 
+`publicUrl` is the public origin, without an application subpath. The current
+full OIDC browser entry and callback use `/api/auth/oidc/login` and
+`/api/auth/oidc/callback`; arbitrary prefixed OIDC hosting is not implemented by
+selecting a different `backendBaseUrl`.
+
 Configure the installation with `tht`:
 
 ```sh
@@ -18,6 +28,9 @@ The OIDC client secret is supplied through the protected secret bundle under the
 `THT_OIDC_CLIENT_SECRET`; it is never written into `auth.yaml`. The default scopes are exactly
 `openid`, `profile`, and `email`.
 
+Keep `AUTH_MODE` unset when using this file. A simultaneously mounted local/OIDC
+configuration and `AUTH_MODE=upstream` is an error, not a fallback chain.
+
 The non-secret OIDC configuration has this exact shape (replace angle-bracket placeholders with
 operator values):
 
@@ -92,3 +105,13 @@ relevant diagnostic surface.
 
 The complete closed diagnostic-code union and exact role-to-permission expansion are in the
 [authentication architecture](../architecture/authentication.md).
+
+## Browser login and logout
+
+ThothII redirects the browser to the provider and creates its own opaque session
+after validating the callback. An existing provider SSO session may avoid another
+password prompt, but this remains a distinct ThothII login/session, unlike Omics
+upstream. Full's name menu logs out of ThothII only. It does not revoke the
+provider session or log out other applications, so a subsequent login can return
+immediately through SSO. No provider token is placed in the UI adapter or browser
+storage. See the [manual acceptance matrix](../testing/authentication-manual-acceptance.md).