feat: dockerfile (node runtime), startup migration, README, runtime env config

server/utils/auth.ts

@@ -45,14 +45,13 @@ function splitCsv(v: unknown): string[] {
 
 let _cached: ReturnType<typeof makeVerifier> | null = null;
 
-/** Process-wide verifier built from runtime config (Nitro server context). */
+/** Process-wide verifier built from environment (read at runtime, not baked at build). */
 export function getVerifier() {
   if (!_cached) {
-    const c = useRuntimeConfig();
     _cached = makeVerifier({
-      issuer: c.zitadelIssuer,
-      audiences: splitCsv(c.zitadelAudience),
-      allowedSubs: splitCsv(c.allowedUserIds),
+      issuer: process.env.ZITADEL_ISSUER || "https://auth.kuns.dev",
+      audiences: splitCsv(process.env.ZITADEL_AUDIENCE),
+      allowedSubs: splitCsv(process.env.ALLOWED_USER_IDS),
     });
   }
   return _cached;