Retrieve OpenID Configuration for current Org

Public OIDC discovery document pointing at the JWKS URIs. No authentication required.

id_token_signing_alg_values_supported is intentionally empty because NICo issues bearer access JWTs, not OIDC id_tokens; strict OIDC client libraries that require a non-empty algorithm list will reject this document. Use the JWKS endpoint directly for signature verification. Returns 404 when no identity material exists for this org/site.