docs: add CAMELEER_OIDC_JWK_SET_URI to all documentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/SERVER-CAPABILITIES.md

@@ -264,7 +264,8 @@ When `CAMELEER_OIDC_ISSUER_URI` is configured, the server accepts external acces
 
 | Variable | Purpose |
 |----------|---------|
-| `CAMELEER_OIDC_ISSUER_URI` | OIDC issuer URI for JWKS discovery (e.g., `https://auth.example.com/oidc`) |
+| `CAMELEER_OIDC_ISSUER_URI` | OIDC issuer URI for token validation (e.g., `https://auth.example.com/oidc`) |
+| `CAMELEER_OIDC_JWK_SET_URI` | Direct JWKS URL (e.g., `http://logto:3001/oidc/jwks`) — use when public issuer isn't reachable from inside containers |
 | `CAMELEER_OIDC_AUDIENCE` | Expected audience (API resource indicator) |
 
 Logto is proxy-aware (`TRUST_PROXY_HEADER=1`). The `LOGTO_ENDPOINT` env var sets the public-facing URL used in OIDC discovery, issuer URI, and redirect URLs. Logto requires its own subdomain (not a path prefix).
@@ -389,6 +390,9 @@ Registry: `gitea.siegeln.net/cameleer/cameleer3-server`
 | `SPRING_DATASOURCE_USERNAME` | No | `cameleer` | PostgreSQL user |
 | `SPRING_DATASOURCE_PASSWORD` | No | `cameleer_dev` | PostgreSQL password |
 | `CAMELEER_DB_SCHEMA` | No | `tenant_{CAMELEER_TENANT_ID}` | PostgreSQL schema (override for feature branches) |
+| `CAMELEER_OIDC_ISSUER_URI` | No | (empty) | OIDC issuer URI — enables resource server mode for M2M tokens |
+| `CAMELEER_OIDC_JWK_SET_URI` | No | (empty) | Direct JWKS URL — bypasses OIDC discovery for container networking |
+| `CAMELEER_OIDC_AUDIENCE` | No | (empty) | Expected JWT audience (API resource indicator) |
 
 ### Health Probes