a161c44575
Real clients now authenticate every local publish against a static mock OIDC issuer, and each type checks unauthenticated publishes are refused while anonymous reads keep working.