big juicy update

.env.example

@@ -3,16 +3,9 @@ DATABASE_URL=postgres://postgres:postgres@localhost:5432/skills_market?sslmode=d
 STORAGE_DIR=uploads
 DEV_MODE=true
 
-OIDC_ISSUER=https://your-oidc-provider.example.com/
-OIDC_AUDIENCE=your-api-audience
-OIDC_JWKS_URL=https://your-oidc-provider.example.com/.well-known/jwks.json
-
-# Required when DEV_MODE=false:
-OIDC_AUTH_URL=https://your-oidc-provider.example.com/authorize
-OIDC_TOKEN_URL=https://your-oidc-provider.example.com/oauth/token
-OIDC_CLIENT_ID=your-client-id
-OIDC_CLIENT_SECRET=your-client-secret
-OIDC_REDIRECT_URL=http://localhost:8080/auth/callback
-
-# Optional:
-OIDC_LOGOUT_URL=
+# Forward auth mode (DEV_MODE=false):
+# Deploy behind Authentik forward-auth and pass identity headers to this app.
+# Expected headers include:
+# - X-Authentik-Uid (required; fallback X-Forwarded-User)
+# - X-Authentik-Email
+# - X-Authentik-Name (fallback X-Forwarded-Preferred-Username)