The Progmasoft Patent Grant is a separate permission added to the
copyright license, not an exception to it, so joining the two with WITH
said something the grant does not do. What makes the grant apply is the
PATENTS notice of the repository (Section 9 of the grant), not the SPDX
expression of each file.

Every project-owned file now carries SPDX-License-Identifier:
AGPL-3.0-or-later, and package.json says the same. PATENTS becomes
PATENTS.md: project-owned software in the repository is covered by the
Patent Grant, Version 1.1, whose canonical text is unchanged under
LICENSES/; third-party material keeps its own terms. NOTICE.txt and the
README point to PATENTS.md.

Claude-Session: https://claude.ai/code/session_01Ji7xZMYjc4zankoc7hGBE1

Progmasoft OAuth now runs on three hosts:

- credentials.progmasoft.com stays the issuer: discovery documents, key
  set, token, user information, revocation and introspection.
- authorize.progmasoft.com serves the pages people see: the
  authorization and end session endpoints (registered with OpenIddict as
  absolute URIs on that host), sign-in, the consent screen and the
  applications an account has allowed.
- console.progmasoft.com is the Progmasoft Console. Its overview links
  the areas; OAuth 2.1 tokens live under /credentials, with New token,
  then the application type, then its form.

The console has no sign-in of its own and never redirects. It uses the
Progmasoft account session, so production now shares that cookie with
progmasoft.com (__Secure-ProgmasoftSession, Domain=progmasoft.com,
HttpOnly, Secure, SameSite=Lax). Without AccountSessions:CookieDomain the
cookie stays host-only with the __Host- name, as in development and tests.

Application types replace the confidential/public switch: web,
single-page, desktop, mobile and service. Each type has its redirection
rules (RFC 8252), its secret or none, and its grants; only a service
uses client credentials and it registers no address or scope. The type is
kept as an application property and cannot change.

The HTML pages of the API are gone. The pages are Next.js pages in four
languages (en-US, de-DE, ru-RU, he-IL) that call JSON endpoints under
/api/v1/oauth. Requests that change state must come from the page's own
origin; antiforgery forms are no longer needed. The token, revocation and
user information endpoints answer CORS requests from the origins of
single-page applications, without credentials; the discovery documents
and the key set answer every origin.

The host filter keeps every path on its host. Nginx gains the authorize
and console virtual hosts, and the docs describe the hosts, the types and
the shared session.