change auth for vmcp

manifest/overlays/production/secrets/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: toolhive-system
+
+# resources:
+#   - state-docs-vmcp-secret.sealed.secret.yaml

manifest/overlays/production/vmcp-servers/full-vmcp.yaml

@@ -23,6 +23,23 @@ spec:
     oidcConfigRef:
       name: full-vmcp-oidc
       audience: toolhive-full-vmcp
+  authServerConfig:
+    issuer: https://full-vmcp.ngorse.com
+    upstreamProviders:
+      - name: keycloak
+        type: oidc
+        oidcConfig:
+          issuerUrl: https://cloak.olb42.com/realms/home-lab
+          clientId: toolhive-full-vmcp
+          clientSecretFile: /var/run/secrets/toolhive/client-secret
+          redirectUri: https://full-vmcp.ngorse.com/oauth/callback
+          scopes:
+            - openid
+            - profile
+            - email
+            - offline_access
+    allowedAudiences:
+      - toolhive-full-vmcp
   config:
     aggregation:
       conflictResolution: prefix

manifest/overlays/production/vmcp-servers/oidcconfig-full-vmcp.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   type: inline
   inline:
-    issuer: https://cloak.olb42.com/realms/home-lab
+    issuer: https://full-vmcp.ngorse.com
     clientId: toolhive-full-vmcp
     clientSecretRef:
       name: toolhive-full-vmcp-secret

manifest/overlays/production/vmcp-servers/oidcconfig-state-docs-vmcp.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   type: inline
   inline:
-    issuer: https://cloak.olb42.com/realms/home-lab
+    issuer: https://state-docs.ngorse.com
     clientId: state-docs-vmcp
     clientSecretRef:
       name: state-docs-vmcp-secret

manifest/overlays/production/vmcp-servers/state-docs-vmcp.yaml

@@ -18,6 +18,23 @@ spec:
     oidcConfigRef:
       name: state-docs-vmcp-oidc
       audience: state-docs-vmcp
+  authServerConfig:
+    issuer: https://state-docs.ngorse.com
+    upstreamProviders:
+      - name: keycloak
+        type: oidc
+        oidcConfig:
+          issuerUrl: https://cloak.olb42.com/realms/home-lab
+          clientId: state-docs-vmcp
+          clientSecretFile: /var/run/secrets/toolhive/client-secret
+          redirectUri: https://state-docs.ngorse.com/oauth/callback
+          scopes:
+            - openid
+            - profile
+            - email
+            - offline_access
+    allowedAudiences:
+      - state-docs-vmcp
   config:
     aggregation:
       conflictResolution: prefix