Enhanced scope with provided capabilities

SCOPE.md

@@ -90,6 +90,24 @@ NetKingdom applications target the "NetKingdom IAM Profile" — a versioned OIDC
 
 ---
 
+## Provided Capabilities
+
+```capability
+type: security
+title: OIDC/PKCE authentication (lightweight mode)
+description: Provides OIDC/PKCE endpoints conforming to the NetKingdom IAM Profile via Authelia + LLDAP + privacyIDEA — a drop-in Keycloak alternative for constrained environments.
+keywords: [oidc, pkce, authentication, iam, sso, authelia, lldap, mfa, identity]
+```
+
+```capability
+type: security
+title: Identity migration tooling
+description: Migrate identities between lightweight (KeyCape) and expanded (Keycloak) IAM modes — LLDAP export, Keycloak import, LDIF generation.
+keywords: [migration, identity, lldap, keycloak, ldif, iam]
+```
+
+---
+
 ## Getting Oriented
 
 - Start with: `wiki/KeyCapeSpecification_v0.1.md` (architecture and design intent)