Align token issuers with the real host instead of legacy DEX hostnames

[elffjs]

What

The two iss values were carried over verbatim from the separate DEX services (auth.dimo.zone for sign-in, auth-roles-rights.dimo.zone for roles/rights). Post-fold, nothing is served at those hosts — the service lives at dauth.dimo.zone/{siwe,permissions} — so the issuers pointed at dead hostnames, and each surface's OIDC discovery document was self-inconsistent (its issuer field didn't match the URL it was served from).

This sets iss = PUBLIC_BASE_URL + surface prefix:

	Before	After
SIWE_ISSUER (prod)	https://auth.dimo.zone	https://dauth.dimo.zone/siwe
PERMISSIONS_ISSUER (prod)	https://auth-roles-rights.dimo.zone	https://dauth.dimo.zone/permissions
dev	auth.dev / auth-roles-rights.dev	dauth.dev.dimo.zone/siwe · /permissions

OIDC Discovery 1.0 appends /.well-known/openid-configuration to the issuer, so a path-suffixed issuer is conformant and now matches where each doc is actually served.

Why no in-process breakage

• The exchange validates the inbound sign-in token signature-only (internal/tokenexchange/middleware/auth.go — no iss check), so the /permissions handoff is unaffected.
• Test fixtures use opaque issuer strings, independent of the deployed values — left as-is.

Build, vet, full test suite (14 pkgs), and helm lint (dev + prod) all green.

Files

• charts/dauth/values{,-prod}.yaml — the deployed config
• internal/config/config.go, internal/tokenexchange/config/settings.go — doc comments + SIWE_ISSUER validation example
• internal/server/handlers.go + generated internal/docs/* — SIWE challenge example string (auth. → dauth.)
• README.md — surfaces table, /challenge example, both ISSUER rows, din's TOKEN_EXCHANGE_ISSUER example

⚠️ Deploy note — flag-day change

Downstream iss-pinning validators must flip to the new values in lockstep with the dauth deploy or they'll reject tokens (these live in other repos / cluster-helm-charts):

• din pins the sign-in iss
• telemetry-api / dq / fetch-api auth0 validators pin the permission iss

🤖 Generated with Claude Code