Move the OAuth pages to Next.js and split the authorize host and the console

Progmasoft OAuth now runs on three hosts:

- credentials.progmasoft.com stays the issuer: discovery documents, key
  set, token, user information, revocation and introspection.
- authorize.progmasoft.com serves the pages people see: the
  authorization and end session endpoints (registered with OpenIddict as
  absolute URIs on that host), sign-in, the consent screen and the
  applications an account has allowed.
- console.progmasoft.com is the Progmasoft Console. Its overview links
  the areas; OAuth 2.1 tokens live under /credentials, with New token,
  then the application type, then its form.

The console has no sign-in of its own and never redirects. It uses the
Progmasoft account session, so production now shares that cookie with
progmasoft.com (__Secure-ProgmasoftSession, Domain=progmasoft.com,
HttpOnly, Secure, SameSite=Lax). Without AccountSessions:CookieDomain the
cookie stays host-only with the __Host- name, as in development and tests.

Application types replace the confidential/public switch: web,
single-page, desktop, mobile and service. Each type has its redirection
rules (RFC 8252), its secret or none, and its grants; only a service
uses client credentials and it registers no address or scope. The type is
kept as an application property and cannot change.

The HTML pages of the API are gone. The pages are Next.js pages in four
languages (en-US, de-DE, ru-RU, he-IL) that call JSON endpoints under
/api/v1/oauth. Requests that change state must come from the page's own
origin; antiforgery forms are no longer needed. The token, revocation and
user information endpoints answer CORS requests from the origins of
single-page applications, without credentials; the discovery documents
and the key set answer every origin.

The host filter keeps every path on its host. Nginx gains the authorize
and console virtual hosts, and the docs describe the hosts, the types and
the shared session.

3 files changed, 10 insertions, 10 deletions

diff --git a/docs/api/namespaces/Progmasoft.OAuth.Api.md b/docs/api/namespaces/Progmasoft.OAuth.Api.md
new file mode 100644
index 0000000..6b657d1
--- /dev/null
+++ b/docs/api/namespaces/Progmasoft.OAuth.Api.md
@@ -0,0 +1,9 @@
+---
+uid: Progmasoft.OAuth.Api
+summary: *content
+---
+
+<!-- SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com> -->
+<!-- SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1 -->
+
+The JSON endpoints under `/api/v1/oauth` that the pages of credentials.progmasoft.com and console.progmasoft.com call: sign-in, consent, the allowed applications, the applications of the console, and the CORS rule for single-page applications.
diff --git a/docs/api/namespaces/Progmasoft.OAuth.Developers.md b/docs/api/namespaces/Progmasoft.OAuth.Developers.md
index 503b35e..e9106ab 100644
--- a/docs/api/namespaces/Progmasoft.OAuth.Developers.md
+++ b/docs/api/namespaces/Progmasoft.OAuth.Developers.md
@@ -6,4 +6,4 @@ summary: *content
 <!-- SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com> -->
 <!-- SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1 -->
 
-The developer portal: the rules an application registration follows, the registry that keeps applications per account, and the portal pages.
+The applications of the Progmasoft Console: their types, the rules each type follows, and the registry that keeps applications per account.
diff --git a/docs/api/namespaces/Progmasoft.OAuth.Pages.md b/docs/api/namespaces/Progmasoft.OAuth.Pages.md
deleted file mode 100644
index b8700aa..0000000
--- a/docs/api/namespaces/Progmasoft.OAuth.Pages.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-uid: Progmasoft.OAuth.Pages
-summary: *content
----
-
-<!-- SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com> -->
-<!-- SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1 -->
-
-The HTML pages of the OAuth host: sign-in, the home page, the applications an account has allowed, and the renderer with its content security policy.