Design spec covers OIDC architecture (RS256 JWKS, WebAuthn-first), 7 service integrations, NetworkPolicy, and phased migration strategy. Implementation plan: 17 tasks across 6 chunks, reviewed 3 rounds (2 internal + 1 external Gemini 2.5 Pro expert review, all fixes applied). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>