d32c14504d
In-cluster pods can't reach the external gateway IP (hairpin NAT). When OIDC_INTERNAL_BASE is set, use explicit OAuth endpoint URLs: - authorizationUrl: external (browser redirect, no server fetch) - tokenUrl/userInfoUrl: internal K8s service (server-to-server) Falls back to discoveryUrl for local dev when not set. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>