[rsdmike]

PR Checklist

• Leverages formatting as provided by https://zensical.org/docs/authoring/tooltips/
• Have viewed and verified edits in rendered form ensuring proper formatting

What are you changing?

Adds a tutorial for turning on OAuth 2.0 / OIDC in Console, aimed at ISVs replacing the default admin login:

• How the mode switch works (auth.clientId), the token rules Console enforces (RS256 JWT, exact iss, aud contains auth.clientId)
• Provider tabs: Microsoft Entra ID, Amazon Cognito (Pre token generation V2_0 trigger to add aud, strict discovery off), Keycloak (audience mapper), other providers
• config.yml and environment variable examples, a settings reference, behaviour changes in OAuth mode, verification steps and troubleshooting

Also creates Tutorials > Authentication and moves the existing MPS tutorial there:

• Tutorials/modifyUserAuth.md -> Tutorials/Authentication/modifyUserAuth.md (nav label "MPS User Authentication"), relative links and image paths updated
• Tutorials overview and the AUTH_CLIENT_ID row in Console Configuration link to the new page

Anything the reviewer should know when reviewing this PR?

• Content is based on Console main (config/config.go, internal/controller/httpapi/v1/login.go, internal/controller/httpapi/ui.go) and the Sample Web UI OAuth setup.
• The old URL Tutorials/modifyUserAuth/ will 404 after publish since the site has no redirect plugin.
• zensical build --strict passes locally. The IdP steps have not been run end to end against live Entra, Cognito or Keycloak tenants.

[Copilot]

🟡 Changes recommended

Provider setup and authentication behavior guidance contain inaccuracies that can block sign-in or mislead operators.

4 open issues

• Document Auth0 audience requirements for embedded UI tokens · New
• Fix Entra discovery validation configuration and documentation · New
• Correct admin password generation and token issuance documentation · New
• Document embedded UI OAuth token expiry and reauthentication · New

What changed in this PR

Adds a Console OAuth/OIDC tutorial and groups authentication guides together in the documentation.

Changes:

• Documents provider setup, Console configuration, token requirements, verification, and troubleshooting.
• Moves the MPS authentication tutorial under Authentication and adjusts its relative links and image paths.
• Adds navigation and reference links to the new tutorial.

File	Description
mkdocs.yml	Groups both tutorials under Authentication.
docs/​Tutorials/​overview.md	Introduces links to both authentication guides.
docs/​Tutorials/​Authentication/​modifyUserAuth.md	Updates relative paths after relocation.
docs/​Tutorials/​Authentication/​consoleOAuth.md	Adds the Console OAuth/OIDC setup guide.
docs/​Reference/​Console/​configuration.md	Links AUTH_CLIENT_ID to the new tutorial.

_{Review effort: Balanced}