docs: document using Gitea as the OAuth issuer

familiar is issuer-agnostic (resource server only), so Gitea can back
oauth mode with config alone: RS256 JWTs, JWKS at /login/oauth/keys, and
OIDC discovery. Add a deployment.md section covering the env config, the
aud=client-ID audience pitfall, and the no-DCR caveat; add a Gitea block
to .env.example; and note in claude-web.md that Gitea can't back the
claude.ai web connector (which requires DCR).

.env.example

@@ -26,10 +26,20 @@ FAMILIAR_HTTP_TOKEN=
 # FAMILIAR_ALLOW_INSECURE_BIND=false
 
 # --- OAuth 2.1 resource server (only when FAMILIAR_AUTH_MODE=oauth) --------- #
+# familiar only validates JWTs; the login/DCR side lives in an external IdP.
 # FAMILIAR_OAUTH_ISSUER=https://idp.example.com/application/o/familiar/
 # FAMILIAR_OAUTH_RESOURCE=https://familiar.example.com   # this server's public URL
 # FAMILIAR_OAUTH_AUDIENCE=https://familiar.example.com   # defaults to RESOURCE
 # FAMILIAR_OAUTH_JWKS_URI=                               # optional; else discovered from issuer
+#
+# Using Gitea as the issuer (RS256 JWTs + JWKS + OIDC discovery — config only,
+# see doc/deployment.md). Register an OAuth2 app in Gitea first; Gitea puts the
+# app's CLIENT ID in the token `aud`, so set AUDIENCE to that, not the resource.
+# NOTE: Gitea has no Dynamic Client Registration — works for clients with a
+# pre-registered client ID/secret, but NOT the claude.ai web connector (needs DCR).
+# FAMILIAR_OAUTH_ISSUER=https://gitea.example.com        # no trailing /login/oauth
+# FAMILIAR_OAUTH_RESOURCE=https://familiar.example.com
+# FAMILIAR_OAUTH_AUDIENCE=<gitea-oauth-app-client-id>
 
 # --- Data / writes --------------------------------------------------------- #
 # Host path holding the encrypted token store (token.enc + key), audit log, and