fix(config): Added config.oidc.jwks_endpoint

[MisheyDev]

Added support to manually configure a JWKS endpoint w/i OIDC config.
See: #619

[pullfrog]

ℹ️ No critical issues — the wiring is correct, but the new option isn't documented.

Reviewed changes

• oidc.jwks_endpoint config option — adds an optional jwks_endpoint to both the full and partial OIDC schemas and passes it through buildOidc as the existing jwksUri field on OidcConfig.

The code change is minimal and matches the surrounding patterns exactly. provider.ts already had first-class support for a manual jwksUri (in fullManual, the discovery override, and the JWKS resolver), so this closes the gap in #619 without any behavioral risk.

ℹ️ jwks_endpoint is not documented

The new option is invisible to users, because the manual-endpoint references elsewhere in the repo weren't updated. config.example.yaml (the manual endpoints block) and docs/features/sso.md (both the "these are usually auto-discovered" list and the "Missing endpoints" troubleshooting entry) enumerate authorization_endpoint, token_endpoint, and userinfo_endpoint but omit jwks_endpoint. Since this PR's purpose is to let users supply a JWKS URL that discovery can't resolve, the option should be documented alongside the other manual endpoints.

Technical details

# Document oidc.jwks_endpoint

## Affected sites
- config.example.yaml:222-224 — manual endpoint block omits jwks_endpoint
- docs/features/sso.md:71-74 — "these are usually auto-discovered" list omits jwks_endpoint
- docs/features/sso.md:354-356 — "Missing endpoints" troubleshooting omits jwks_endpoint
- nix/options.nix:357-400 — Nix module mirrors some oidc endpoints (optional: add jwks_endpoint here too)

## Required outcome
- jwks_endpoint appears alongside the other manual endpoint overrides in config.example.yaml and docs/features/sso.md

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using DeepSeek Pro (free via Pullfrog for OSS) ｜ 𝕏}

[tale]

Please update the documentation (the example config.yaml should be fine).

[MisheyDev]

Sorry for the delay! I added it to the config.example.yaml, as well as sso.md and options.nix. Please let me know if there's anything else you'd like to see updated; I'll get to it faster this time :)

[pullfrog]

✅ No new issues found.

Reviewed changes

• Documented oidc.jwks_endpoint — added the key to config.example.yaml's manual-endpoint block and to both docs/features/sso.md locations: the config example and the "Missing endpoints" troubleshooting entry.
• Added a Nix option — services.headplane.settings.oidc.jwks_endpoint mirrors the existing manual endpoint overrides as nullOr str with a null default, so the module renders it into the generated YAML without any module.nix change.

This resolves the documentation gap flagged in the prior review and the maintainer's requested change. The code wiring from the first commit (config-schema.ts, context.ts) is untouched and remains correct: jwksUri is consumed both in the fullManual path and as the discovery override in provider.ts.

  ^{｜ View workflow run ｜ Using openrouter/deepseek/deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}