feat: add oauth2 login against myep

.env

@@ -46,3 +46,22 @@ MESSENGER_TRANSPORT_DSN=doctrine://default?auto_setup=0
 ###> symfony/mailer ###
 MAILER_DSN=null://null
 ###< symfony/mailer ###
+
+###> app/myep-oauth2 ###
+# OAuth2 against myep, the EP identity provider. ephub is a confidential client using the
+# authorization_code grant; it reads /api/userinfo once at login and then uses its own session,
+# so the 10-minute access token is never stored or refreshed.
+#
+# Credentials come from `league:oauth2-server:create-client` ON MYEP. Register the callback
+# https://ephub.ddev.site/auth/check for local dev, plus the production host. Leave the id and
+# secret empty until then -- the login page detects it and says so.
+#
+# `email` is the identity claim. Do NOT use profile.communication.email: it comes from the CRM
+# address record and is not necessarily the login email.
+EP_OAUTH2_CLIENT_ID=
+EP_OAUTH2_CLIENT_SECRET=
+EP_OAUTH2_URL_AUTHORIZE=https://myep.ddev.site/authorize
+EP_OAUTH2_URL_ACCESS_TOKEN=https://myep.ddev.site/token
+EP_OAUTH2_URL_USERINFO=https://myep.ddev.site/api/userinfo
+EP_OAUTH2_SCOPES=email,profile,roles
+###< app/myep-oauth2 ###