OIDC: register coop.cool as a second client (Curated Learn admin)

Adds a coop-cool relying party alongside outline-wiki so the coop.cool
Curated Learn admin can authenticate against this provider. Redirect URIs
cover coop.cool prod + the local dev callback (:3004). The client secret
comes from COOP_COOL_OIDC_CLIENT_SECRET and must match coop.cool's
OIDC_CLIENT_SECRET.

server/utils/oidc-provider.ts

@@ -43,6 +43,20 @@ export async function getOidcProvider() {
         response_types: ["code"],
         token_endpoint_auth_method: "client_secret_post",
       },
+      {
+        // coop.cool — second relying party. Curated Learn admin signs in here.
+        client_id: process.env.COOP_COOL_OIDC_CLIENT_ID || "coop-cool",
+        client_secret: process.env.COOP_COOL_OIDC_CLIENT_SECRET || "",
+        redirect_uris: [
+          "https://coop.cool/auth/callback",
+          // Local development callback (coop.cool dev server runs on :3004)
+          "http://localhost:3004/auth/callback",
+        ],
+        post_logout_redirect_uris: ["https://coop.cool", "http://localhost:3004"],
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        token_endpoint_auth_method: "client_secret_post",
+      },
     ],
 
     claims: {