Client-auth discovery: issuer, endpoints, sign-in apps, realm switches, providers

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.