seed: add fortuna-web public OIDC client (audience=fortuna) (#465)

Adds the fortuna-web PUBLIC OIDC/PKCE client so the fortuna web app can 'Sign
in with Janua'. audience=fortuna matches what fortuna-api enforces on the Janua
JWT (services/api/app/core/auth.py + config.py janua_audience default 'fortuna'),
so OIDC-minted tokens carry aud=fortuna and are accepted — unlike the session-API
tokens (aud=janua.dev) the web currently obtains. redirect_uri is
https://fortuna.tube/auth/callback (SDK default ${origin}/auth/callback) + localhost.

tezca-web already existed with audience=tezca-api. Operator runs this seed
(Janua uniformity console gate) to register both in prod.

Co-authored-by: Aldo R. L. <aldo.ruiz.luna@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

apps/api/scripts/seed_oidc_clients.py

@@ -137,6 +137,19 @@
             "http://localhost:3000/auth/callback",
         ],
     },
+    {
+        "client_id": "fortuna-web",
+        "name": "fortuna-web",
+        "description": "Fortuna opportunity-intelligence web app — Sign in with Janua (OIDC/PKCE)",
+        # Must match the audience fortuna-api enforces on the Janua JWT, so the
+        # OIDC-minted access token carries aud=fortuna (session-API tokens carry
+        # the global janua.dev audience and are rejected by fortuna-api).
+        "audience": "fortuna",
+        "redirect_uris": [
+            "https://fortuna.tube/auth/callback",
+            "http://localhost:3000/auth/callback",
+        ],
+    },
     {
         "client_id": "dashboard",
         "name": "dashboard",