Implement NetKingdom identity shell for coulomb.social (CSOC-WP-0002)

Django scaffold aligned with the business delivery lane: tenant-keyed
Member model without passwords, identity app as sole OIDC/session
boundary, dev-claims login, authenticated /app/ shell, ADR-0001, and
tests. T01/T02/T05/T06 done; OIDC registration, real user-engine HTTP,
flex-auth, and packaging remain open.

docs/identity/oidc-client.md

@@ -0,0 +1,25 @@
+# OIDC client binding (coulomb.social)
+
+Non-secret registration checklist for NetKingdom IAM Profile issuers.
+
+| Field | Value / notes |
+|-------|----------------|
+| Application | coulomb.social |
+| Profile | NetKingdom IAM Profile (PKCE required) |
+| client_id | set per environment (`OIDC_CLIENT_ID`) |
+| client_secret | OpenBao / local 0600 only — never Git |
+| redirect_uri (dev) | `http://127.0.0.1:8008/auth/callback/` |
+| redirect_uri (prod) | `https://coulomb.social/auth/callback/` (confirm at deploy) |
+| scopes | `openid profile email` (+ profile claims as issuer provides) |
+| grant | authorization_code + PKCE S256 |
+| wildcard redirects | **forbidden** (KeyCape constraint) |
+
+## Status
+
+| Environment | Issuer mode | Registered |
+|-------------|-------------|------------|
+| local | dev claims (`OIDC_ENABLED=false`) | n/a |
+| platform | KeyCape / local-identity / Keycloak | pending operator registration (T03) |
+
+When registering, record the live client_id here (not the secret) and the
+issuer base URL in deploy notes.

docs/identity/smoke.md

@@ -0,0 +1,23 @@
+# Identity smoke checklist
+
+## Offline (dev claims)
+
+1. `uv sync && uv run manage.py migrate && uv run manage.py runserver 8008`
+2. Open `/` → **Sign in**
+3. Dev form → submit subject `smoke-1`
+4. Land on `/app/` with display name and subject shown
+5. **Sign out** → back to landing; `/app/` redirects to login
+6. Sign in again with same subject → single `Member` row (idempotent)
+
+## With platform OIDC
+
+1. Set `OIDC_ENABLED=true` and issuer/client/redirect env vars
+2. Register redirect URI at the issuer (no wildcards)
+3. `/auth/login/` redirects to IdP; callback creates/links Member
+4. Logout clears app session
+
+## Automated
+
+```bash
+make test
+```

docs/identity/user-engine-binding.md

@@ -0,0 +1,23 @@
+# user-engine application binding
+
+| Field | Value |
+|-------|--------|
+| application id | `coulomb-social` (`USER_ENGINE_APPLICATION_ID`) |
+| display name | coulomb.social |
+| tenant (v1) | `binky` (client #1) |
+| identity link | `(issuer, sub)` → `user_engine_user_id` on first login |
+| local row | `members.Member` (no passwords) |
+
+## Runtime
+
+| Mode | Behavior |
+|------|----------|
+| `USER_ENGINE_BASE_URL` empty | `StubUserEngineClient` — deterministic user id from issuer+sub hash |
+| URL set | `HttpUserEngineClient` placeholder (T04: wire real link/projection API) |
+
+## Profile attributes (shell only)
+
+- display name (from OIDC `name` / `preferred_username`)
+- email (optional)
+
+Bubble content fields are **not** part of this binding.