feat(sso): Add LearnFlow SSO public client

- Add learnflow-sso-public-client to trusted clients
- Configure redirect URLs for localhost and learnflow.avixato.com
- Add client to seed script for database seeding
- Fix Taskflow URLs to use avixato.com consistently

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: mjunaidca

apps/sso/scripts/seed-prod-client.ts

@@ -39,7 +39,8 @@ const TASKFLOW_SSO_CLIENT = {
   name: "Taskflow SSO",
   redirectUrls: [
     "http://localhost:3000/api/auth/callback",
-    "https://taskflow.org/api/auth/callback",
+    "https://avixato.com/api/auth/callback",
+    "https://api.avixato.com/auth/callback",
   ].join(","),
   type: "public",
   disabled: false,
@@ -68,6 +69,24 @@ const AI_NATIVE_CLIENT = {
   }),
 };
 
+const LEARNFLOW_SSO_CLIENT = {
+  id: "learnflow-sso-public-client-id",
+  clientId: "learnflow-sso-public-client",
+  clientSecret: null,
+  name: "LearnFlow SSO",
+  redirectUrls: [
+    "http://localhost:3000/api/auth/callback",
+    "https://learnflow.avixato.com/api/auth/callback",
+  ].join(","),
+  type: "public",
+  disabled: false,
+  metadata: JSON.stringify({
+    token_endpoint_auth_method: "none",
+    grant_types: ["authorization_code", "refresh_token"],
+    description: "LearnFlow educational course platform",
+  }),
+};
+
 async function upsertClient(client: typeof TASKFLOW_SSO_CLIENT) {
   const existing = await db
     .select()
@@ -116,12 +135,14 @@ async function seed() {
 
   await upsertClient(TASKFLOW_SSO_CLIENT);
   await upsertClient(AI_NATIVE_CLIENT);
+  await upsertClient(LEARNFLOW_SSO_CLIENT);
 
   // Verify and display all production clients
   const allClients = await db.select().from(oauthApplication);
   const prodClients = allClients.filter(c =>
     c.clientId === TASKFLOW_SSO_CLIENT.clientId ||
-    c.clientId === AI_NATIVE_CLIENT.clientId
+    c.clientId === AI_NATIVE_CLIENT.clientId ||
+    c.clientId === LEARNFLOW_SSO_CLIENT.clientId
   );
 
   console.log("\n✅ Successfully configured!\n");

apps/sso/src/lib/trusted-clients.ts

@@ -109,6 +109,18 @@ export const TRUSTED_CLIENTS = [
     skipConsent: true,
     metadata: {},
   },
+  {
+    clientId: "learnflow-sso-public-client",
+    name: "LearnFlow SSO",
+    type: "public" as const,
+    redirectUrls: filterRedirectUrls([
+      "http://localhost:3000/api/auth/callback",
+      "https://learnflow.avixato.com/api/auth/callback",
+    ]),
+    disabled: false,
+    skipConsent: true,
+    metadata: {},
+  },
   // =============================================================================
   // MCP OAuth Clients - 014-mcp-oauth-standardization
   // These clients use Device Authorization Flow (RFC 8628) for headless auth
@@ -216,6 +228,11 @@ export const CLIENT_DESCRIPTIONS = {
     audience: "All Taskflow users across platforms",
     security: "Public client with PKCE, no client secret",
   },
+  "learnflow-sso-public-client": {
+    purpose: "LearnFlow educational course platform",
+    audience: "Teachers and students using LearnFlow",
+    security: "Public client with PKCE, no client secret",
+  },
   "ai-native-public-client": {
     purpose: "AI Native development platform",
     audience: "Developers building AI applications",