OIDC Provider. Per-team issuer = /o/{slug}. Discovery at /o/{slug}/.well-known/openid-configuration.
/o/{slug}
/o/{slug}/.well-known/openid-configuration