Add webfinger endpoint

Serve /.well-known/webfinger for federated-identity discovery.

Co-Authored-By: Claude Opus 5 <[email protected]>

app/.well-known/webfinger/route.ts

@@ -0,0 +1,25 @@
+// WebFinger endpoint (RFC 7033) served at /.well-known/webfinger.
+// Points OIDC relying parties (e.g. Tailscale) at the Authentik issuer
+// for acct:[email protected].
+
+const WEBFINGER = {
+  subject: 'acct:[email protected]',
+  links: [
+    {
+      href: 'https://auth.cloudrite.co.nz/application/o/tailscale/',
+      rel: 'http://openid.net/specs/connect/1.0/issuer',
+    },
+  ],
+}
+
+export async function GET() {
+  return new Response(JSON.stringify(WEBFINGER), {
+    headers: {
+      // RFC 7033 requires the JRD media type, not application/json.
+      'content-type': 'application/jrd+json; charset=utf-8',
+      // WebFinger responses are cross-origin fetched by relying parties.
+      'access-control-allow-origin': '*',
+      'cache-control': 'public, max-age=3600',
+    },
+  })
+}