ops: OIDC issuer deployment wiring — key volume, CORS for files, Drive authMode flip

infra/occupymedia/docker-compose.app.yml

@@ -65,7 +65,7 @@ services:
       S3_KEK: ${S3_KEK:?}
       SUPERPOSTER_KEK: ${SUPERPOSTER_KEK:?}
       SESSION_SECRET: ${SESSION_SECRET:?}
-      CORS_ORIGINS: https://app.occupymedia.cc
+      CORS_ORIGINS: https://app.occupymedia.cc,https://files.occupymedia.cc
       PUBLIC_ORIGIN: https://app.occupymedia.cc
       WEB_ORIGIN: https://app.occupymedia.cc
       API_PUBLIC_URL: https://api.occupymedia.cc
@@ -98,6 +98,10 @@ services:
       # Publishing workflows and the scheduler worker MUST share one queue,
       # else approved publishes sit unconsumed.
       TEMPORAL_TASK_QUEUE: ${TEMPORAL_TASK_QUEUE:-tmbh-publishing}
+      # Hub-as-OIDC-issuer signing keys (see docs/design/2026-10-13-files-oidc-sso.md).
+      OIDC_KEY_DIR: /var/lib/tmbh/oidc
+    volumes:
+      - oidckeys:/var/lib/tmbh/oidc
     ports: ["3000:3000"]
     depends_on:
       postgres: { condition: service_healthy }
@@ -168,3 +172,4 @@ volumes:
   pgdata:
   redisdata:
   mediaworkerstate:
+  oidckeys: