Host chmod cannot open 0700 dirs owned by UID 1000, so
`-f` never sees root_ca.crt. Chmod from inside the
container as root while waiting for the cert.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Fill in certificate renewal processing, preserve OAuth and JWKS
edge cases, embed the compliance-portal app in production builds,
and close the smaller portal routing and n8n update gaps.
Signed-off-by: Bryan Frimin <bryan@probo.com>
Teach CIMD registration and discovery about per-portal client
metadata, and carry portal context through token and ID token
issuance for downstream session creation.
Signed-off-by: Bryan Frimin <bryan@probo.com>