Slate ID

CandySlate First-Party Identity Provider in passkey-first scaffold state.

• Issuer default: https://auth.candyslate.com
• WebAuthn RP ID default: candyslate.com
• OIDC provider base is scaffolded via Doorkeeper.
• Passwordless is the intended default path. Recovery remains a separate concern.