Rebrand product as Manyangles and add Authentik

README.md

@@ -1,4 +1,4 @@
-# Vellum
+# Manyangles
 
 Event photo collection for a wedding day — and for any gathering that needs
 the same guest-upload, host-moderate, public-gallery loop.
@@ -46,3 +46,32 @@ Example accounts (password `host`, admin password `admin`):
 - `admin@example.com` — platform super-admin
 - `host@example.com` / `partner@example.com` — event owners
 - `manager@example.com` — event manager
+
+## Authentik sign-in
+
+Manyangles can use an Authentik OAuth2/OpenID Connect provider alongside email and
+password authentication. In Authentik, create a confidential OAuth2/OpenID
+provider and application with the `openid`, `profile`, and `email` scopes.
+
+Add a strict redirect URI for each Manyangles deployment:
+
+```text
+https://photos.example.com/api/auth/oauth2/callback/authentik
+```
+
+For local development, use
+`http://localhost:3000/api/auth/oauth2/callback/authentik`.
+
+Set all three variables to enable the Authentik button:
+
+```dotenv
+AUTHENTIK_ISSUER=https://auth.example.com/application/o/manyangles/
+AUTHENTIK_CLIENT_ID=your-client-id
+AUTHENTIK_CLIENT_SECRET=your-client-secret
+```
+
+`AUTHENTIK_ISSUER` is the application issuer URL, not the Authentik root URL.
+Manyangles discovers the authorization, token, user-info, and signing-key endpoints
+from `<issuer>/.well-known/openid-configuration`. If none of these variables are
+set, Authentik support stays disabled. A partial configuration fails at startup
+instead of silently hiding a broken provider.