fix: let deployments advertise offline_access so MCP sessions can refresh

MCP clients were being kicked back to an interactive login on a short
cycle, reporting "requires re-authorization (token expired)".

Cause: /.well-known/oauth-protected-resource advertised only
openid/profile/email plus the audience scope. A client requests exactly
the scopes it finds there, and Authentik issues a refresh token only when
offline_access is among them — so the client received an access token
with nothing to renew it with. Once that token aged out, re-authenticating
by hand was the only path forward.

This is the same trap the audience scope already documents one comment
further up: a scope missing from this document is a scope the client will
never ask for, however the IdP is configured.

Adds OIDC_OFFLINE_ACCESS (default false). Enabling it appends
offline_access to the advertised scopes.

Left opt-in rather than always-on because it is only half the fix — the
IdP also needs an offline_access scope mapping on the provider, and
advertising a scope the IdP doesn't offer risks an invalid_scope
rejection that would break authentication outright. A deployment turns
this on after configuring its IdP; README documents both halves and how
to verify each.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

apps/web/lib/env.ts

@@ -52,6 +52,20 @@ const envSchema = z.object({
   // Defaults to the `aud-<audience>` convention used in the README setup.
   OIDC_AUDIENCE_SCOPE: optional(z.string().min(1)),
 
+  // Advertise `offline_access` in the protected-resource metadata.
+  //
+  // Without it the IdP issues an access token and NO refresh token, so an
+  // MCP client cannot renew silently — it has to send the user back through
+  // an interactive login every time the access token expires. Turning this
+  // on is what makes long-lived sessions stop dropping out.
+  //
+  // Defaults OFF because it is only half the fix: the IdP must also have an
+  // `offline_access` scope mapping on the provider. Advertising a scope the
+  // IdP doesn't offer risks an `invalid_scope` rejection that would break
+  // authentication outright, so a deployment opts in only after configuring
+  // its IdP. See README -> "Keeping sessions alive".
+  OIDC_OFFLINE_ACCESS: Bool.optional().default(false),
+
   // Database
   DATABASE_URL: z.string().url(),
 
@@ -119,6 +133,7 @@ function buildPhaseStub(): Env {
     CLI_TOKEN_SECRET: "build-phase-secret-not-used-at-runtime-xxxxxxxx",
     PLUGIN_MARKETPLACE_NAME: "shared-memory",
     ALLOW_INSECURE_HTTP: false,
+    OIDC_OFFLINE_ACCESS: false,
   };
 }