Guide to connecting a real identity provider #99

The secure-the-API guides stop at https://login.example.com. Engineers need the real --authority and --audience values for the common identity providers, a way to get a token on their own machine, and a clear warning that an empty Authority leaves every endpoint open.

Phase 1: The guide

• A table of Authority and Audience values for Microsoft Entra ID, Auth0, Amazon Cognito and Keycloak, per web template and MCP
• Getting a token locally (dotnet user-jwts or the provider's own tool) and using it in Scalar, Presentation.http, Nitro and the MCP Inspector
• An Aside on what an empty Authority means, linked to the December safe-by-default work

Checks: the site builds, and each provider's values are checked against its own docs.