feat: Initialize JWT-scoped tools

docker-compose.yml

@@ -73,10 +73,36 @@ services:
       - NEXTCLOUD_HOST=http://app:80
       - NEXTCLOUD_MCP_SERVER_URL=http://127.0.0.1:8001
       - NEXTCLOUD_PUBLIC_ISSUER_URL=http://127.0.0.1:8080
-      # No USERNAME/PASSWORD - will use OAuth
+      - NEXTCLOUD_OIDC_CLIENT_STORAGE=/app/.oauth/nextcloud_oauth_client.json
+      - NEXTCLOUD_OIDC_SCOPES=openid profile email nc:read nc:write
+      # No USERNAME/PASSWORD - will use OAuth with Dynamic Client Registration
+      # Client credentials will be registered and stored in volume on first startup
     volumes:
       - oauth-client-storage:/app/.oauth
 
+  mcp-oauth-jwt:
+    build: .
+    command: ["--transport", "streamable-http", "--oauth", "--port", "8002"]
+    restart: always
+    depends_on:
+      - app
+    ports:
+      - 127.0.0.1:8002:8002
+    environment:
+      #- NEXTCLOUD_HOST=http://app:80
+      - NEXTCLOUD_HOST=http://host.docker.internal:8080
+      - NEXTCLOUD_MCP_SERVER_URL=http://127.0.0.1:8002
+      - NEXTCLOUD_PUBLIC_ISSUER_URL=http://localhost:8080
+      - NEXTCLOUD_OIDC_CLIENT_STORAGE=/var/www/html/.oauth-jwt/nextcloud_oauth_client.json
+      - NEXTCLOUD_OIDC_SCOPES=openid profile email nc:read nc:write
+      # No USERNAME/PASSWORD - will use OAuth with JWT tokens
+      # Client credentials auto-generated by app container post-installation hook
+    volumes:
+      # NOTE: JWT-enabled OIDC client credentials created during nextcloud installation scripts
+      - nextcloud:/var/www/html:ro
+    extra_hosts:
+      - host.docker.internal:host-gateway
+
 volumes:
   nextcloud:
   db: