feat: zitadel provisioning script + project-audience scope

.env.example

@@ -14,6 +14,8 @@ WEB_ORIGIN=https://claudedo.kuns.dev
 # --- Web client (public, exposed to browser) ---
 NUXT_PUBLIC_ZITADEL_ISSUER=https://auth.kuns.dev
 NUXT_PUBLIC_ZITADEL_CLIENT_ID=
+# Zitadel project id — adds the project-audience scope at login so the API can validate `aud`
+NUXT_PUBLIC_ZITADEL_PROJECT_ID=
 
 # --- Provisioning script only (not needed at runtime) ---
 # Zitadel Management API PAT (from ~/.secrets/coolify-tokens.env: ZITADEL_SERVICE_TOKEN)