fix: let deployments advertise offline_access so MCP sessions can refresh

MCP clients were being kicked back to an interactive login on a short
cycle, reporting "requires re-authorization (token expired)".

Cause: /.well-known/oauth-protected-resource advertised only
openid/profile/email plus the audience scope. A client requests exactly
the scopes it finds there, and Authentik issues a refresh token only when
offline_access is among them — so the client received an access token
with nothing to renew it with. Once that token aged out, re-authenticating
by hand was the only path forward.

This is the same trap the audience scope already documents one comment
further up: a scope missing from this document is a scope the client will
never ask for, however the IdP is configured.

Adds OIDC_OFFLINE_ACCESS (default false). Enabling it appends
offline_access to the advertised scopes.

Left opt-in rather than always-on because it is only half the fix — the
IdP also needs an offline_access scope mapping on the provider, and
advertising a scope the IdP doesn't offer risks an invalid_scope
rejection that would break authentication outright. A deployment turns
this on after configuring its IdP; README documents both halves and how
to verify each.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -291,9 +291,49 @@ tokens carry `aud: shared-memory` (or whatever value you chose).
 - **Client ID:** auto-generated → copy to `.env` as `OIDC_CLIENT_ID_MCP`
 - **Redirect URIs:** Claude Code prints the exact value when it first
   connects to the MCP endpoint. Paste it into Authentik then.
-- **Scopes:** `openid`, `profile`, `email`
+- **Scopes:** `openid`, `profile`, `email` (plus `offline_access` — see
+  **Keeping sessions alive** below)
 - **Signing Key:** same cert as the Web provider
 
+#### Keeping sessions alive (`offline_access`)
+
+Without this, a connected MCP client gets an access token and **no refresh
+token**. It cannot renew silently, so the moment the access token expires the
+client reports `requires re-authorization (token expired)` and the user has to
+log in again — repeatedly, on a short cycle.
+
+Two changes are required, and **neither works alone**:
+
+1. **In Authentik**, edit the `shared-memory-mcp` provider and add the built-in
+   `authentik default OAuth Mapping: offline_access` to its **Scopes**. You can
+   confirm it took by checking that `offline_access` appears in:
+
+   ```bash
+   curl -s https://auth.example.com/application/o/shared-memory-mcp/.well-known/openid-configuration \
+     | jq .scopes_supported
+   ```
+
+2. **In `.env`**, set `OIDC_OFFLINE_ACCESS=true` and redeploy.
+
+Step 2 is needed because a client only requests the scopes advertised in our
+`/.well-known/oauth-protected-resource` document — the same mechanism that
+makes the `aud` scope mapping necessary below. Step 1 is needed because
+Authentik only issues a refresh token when a configured mapping is requested.
+
+It is left opt-in rather than always-on because advertising a scope the IdP
+doesn't offer risks an `invalid_scope` rejection that breaks authentication
+outright. Configure the IdP first, then flip the flag.
+
+Verify afterwards with:
+
+```bash
+curl -s https://memory.example.com/.well-known/oauth-protected-resource | jq .scopes_supported
+```
+
+If interactive login isn't practical at all — a headless container, CI — skip
+OAuth and use a static bearer token instead (**D. Static bearer token**, below);
+those default to a 90-day lifetime.
+
 #### Setting the `aud` claim
 
 The MCP endpoint requires the access token's `aud` claim to equal