auth: OpenID session check, live Keycloak test, sign-in guide (S3)

Spec 12 S3: job oidcCheck refreshes every OpenID session at the provider every 15 minutes and
applies groups and role again; invalid_grant ends the session, an outage doesn't. A live test
makes a throwaway Keycloak realm and signs in through its login form (passed against 26.8.1).
NODE_EXTRA_CA_CERTS for a private CA. Admin guide: docs/admin-guide/sign-in.md.

.env.example

@@ -26,3 +26,6 @@ RTP_PORT_END=20000                   # firewall and router. Two ports per call;
 #AI_TTS_URL=http://127.0.0.1:8000/v1
 #AI_TTS_MODEL=speaches-ai/Kokoro-82M-v1.0-ONNX
 #AI_TTS_VOICE=af_heart
+# A private CA your identity provider or directory uses (admin guide: Sign-in). Put the PEM file
+# in data/tls/; the api reads it at start, so restart the api after changing it.
+#NODE_EXTRA_CA_CERTS=/var/lib/selfphoneng/tls/idp-ca.pem