rework

deploy/config.example.yaml

@@ -207,10 +207,13 @@ api:
     read_only_api_keys: []
     trust_loopback: true
     session_ttl: 12h
-    # For mode: oidc, configure a registered public PKCE client and the API
-    # audience included in its access tokens. Users need the admin role to write.
+    # For mode: oidc, register a public PKCE client with this callback.
+    # Go exchanges codes and keeps tokens in an HttpOnly cookie session;
+    # no token-endpoint CORS setting is needed. The audience must be included
+    # in access tokens. Users need the admin role to write.
     oidc_issuer: https://users.k6n.net
     oidc_audience: https://fancy-dns.example.net
+    oidc_redirect_uri: https://fancy-dns.example.net/auth/oidc/callback
     oidc_client_id: fancy-dns
     oidc_write_roles: [admin]
   rate_limit: