Feat add iam auth

.env.example

@@ -38,6 +38,44 @@ JWT_CUSTOMER_SECRET=
 # Customer token lifetime (default 30d).
 JWT_CUSTOMER_EXPIRES_IN=
 
+# ---------------------------------------------------------------------------
+# Central IAM — delegated admin login (docs/iam-sso.md)
+# ---------------------------------------------------------------------------
+# OFF by default. When off, nothing changes: admin login stays a local bcrypt
+# check and no request ever leaves this server.
+#
+# When on, the admin's phone + password are verified against the central
+# identity service instead. There is NO UI change: no SSO button, no redirect.
+# If the identity service is unreachable or does not know the account, the
+# local password check still runs (see IAM_LOGIN_DELEGATION).
+IAM_ENABLED=false
+IAM_ISSUER=
+# The client must be registered there as confidential AND trusted.
+IAM_CLIENT_ID=
+IAM_CLIENT_SECRET=
+# One of the two; tenant_id wins when both are set.
+IAM_TENANT_ID=
+IAM_TENANT_SLUG=
+# off | fallback (default, safest) | exclusive (local password no longer accepted)
+IAM_LOGIN_DELEGATION=fallback
+IAM_HTTP_TIMEOUT_MS=8000
+
+# Revocable admin sessions (AdminSession table).
+#
+# An admin token is self-contained and lives for JWT_EXPIRES_IN (12h), so until
+# this existed nothing could end a session early — not disabling the account, not
+# a central sign-out. Every issued token now carries a `jti` recorded in the
+# database, and a revoked row is refused on the next request.
+#
+# Unset = follows IAM_ENABLED (on with the IAM, so central revocation reaches
+# here). `true` turns it on without the IAM; `false` opts out of the per-request
+# lookup and central revocation then cannot end a session here.
+AUTH_SESSION_TRACKING=
+
+# To let the IAM end sessions here, register this path on the client there as its
+# backchannel_logout_uri:
+#   https://<api-host>/api/iam/backchannel-logout
+
 # ---------------------------------------------------------------------------
 # ⚠ DELIVERY ONLY — REMOVE BEFORE THE REAL RELEASE (D20 / ISSUES REL-01)
 # ---------------------------------------------------------------------------