docs(auth): document local OIDC and Authentik operation

scripts/auth-docs-smoke.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)
+docs=(
+  "$root/docs/architecture/authentication.md"
+  "$root/docs/install/authentication-local.md"
+  "$root/docs/install/authentication-oidc.md"
+  "$root/docs/install/authentik.md"
+  "$root/docs/testing/authentication-manual-acceptance.md"
+  "$root/docs/architecture/overview.md"
+  "$root/docs/install/local.md"
+  "$root/docs/install/server.md"
+  "$root/docs/install/psd-workspace-setup.md"
+  "$root/docs/install/reverse-proxy-caddy.md"
+  "$root/docs/install/reverse-proxy-nginx.md"
+  "$root/docs/guida-utente.md"
+  "$root/docs/index.md"
+  "$root/README.md"
+  "$root/PROJECT_STATE.md"
+)
+
+for path in "${docs[@]}"; do
+  [[ -f "$path" ]] || { echo "auth docs smoke: missing $path" >&2; exit 1; }
+done
+
+corpus=$(mktemp)
+trap 'rm -f "$corpus"' EXIT
+cat "${docs[@]}" >"$corpus"
+
+required=(
+  "tht auth"
+  "groups"
+  "TOT Admin"
+  "THT_OIDC_CLIENT_SECRET"
+  "THT_AUTHENTIK_API_TOKEN"
+  "Remember me"
+  "oidc_mapped_group_missing"
+)
+for term in "${required[@]}"; do
+  rg -Fq "$term" "$corpus" || { echo "auth docs smoke: missing required term: $term" >&2; exit 1; }
+done
+
+if rg -n -i 'thothii-admin|thothctl[[:space:]]+auth' "$corpus"; then
+  echo "auth docs smoke: forbidden authentication CLI wording" >&2
+  exit 1
+fi
+if rg -n -i 'password[[:space:]]*[:=][[:space:]]*(?!<|YOUR|REPLACE|CHANGE|FILE|PROMPT)' --pcre2 "$corpus"; then
+  echo "auth docs smoke: plaintext password example" >&2
+  exit 1
+fi
+if rg -n -i 'unmapped[^.]{0,100}(generate|produce|emit|cause)[^.]{0,100}(warning|warn)|unmapped[^.]{0,100}warning(s)?[[:space:]]+(are|is)[[:space:]]+emitted' "$corpus"; then
+  echo "auth docs smoke: misleading warning claim for unmapped groups" >&2
+  exit 1
+fi
+
+echo "auth docs smoke: required terms and forbidden wording checks passed"