No manifest change yet — proxyAuth stays active, so get_identity() still works via header. OIDC routes only activate when CLOUDRON_OIDC_* env vars are present. Validates id_token signature (JWKS), iss/aud/nonce, exp/nbf.