Merge branch 'worktree-agent-a34a6a8b'

# Conflicts:
#	internal/api/router.go

internal/api/router.go

@@ -176,6 +176,7 @@ func (s *Server) Router() chi.Router {
 		r.Post("/auth/login", s.rateLimitedLogin(loginLimiter))
 		r.Get("/auth/oidc/login", s.oidcLogin)
 		r.Get("/auth/oidc/callback", s.oidcCallback)
+		r.Post("/auth/oidc/token", s.oidcExchangeToken)
 
 		// Webhook handler (uses its own secret-based auth).
 		r.Mount("/webhook", s.webhook.Route())
@@ -187,6 +188,7 @@ func (s *Server) Router() chi.Router {
 			// Read-only endpoints (any authenticated user).
 			r.Get("/health", s.getHealth)
 			r.Get("/auth/me", s.currentUser)
+			r.Post("/auth/logout", s.logout)
 			r.Get("/projects", s.listProjects)
 			r.Route("/projects/{id}", func(r chi.Router) {
 				r.Get("/", s.getProject)
@@ -281,6 +283,8 @@ func (s *Server) Router() chi.Router {
 				r.Put("/auth/settings", s.updateAuthSettings)
 				r.Get("/auth/users", s.listUsers)
 				r.Post("/auth/users", s.createUser)
+				r.Put("/auth/users/{uid}", s.updateUser)
+				r.Put("/auth/users/{uid}/password", s.changePassword)
 				r.Delete("/auth/users/{uid}", s.deleteUser)
 
 				// Project creation.