chore: Update Readme

apps/auth/README.md

@@ -0,0 +1,32 @@
+# apps/auth
+
+The authentication worker for Nestri — a Cloudflare Worker built on
+[`@nestri/auth`](../../packages/auth/README.md) (OpenAuth-style issuer).
+
+## What it does
+
+Hosts the OpenID Connect / OAuth issuer and the login UI:
+
+- **Steam OAuth** — the primary login flow. After Steam redirects back, the worker fetches the
+  player's profile, creates (or finds) the `User` + `LinkedAccount` rows in Postgres, auto-creates a
+  personal team on first login, and issues a JWT `user` subject containing `{ userID, linkedAccountID }`.
+- **SSH login** — authenticates a device via its SSH fingerprint (keyed by `SSH_AUTH_KEY`),
+  resolving the identity through `Steam.resolveSshIdentity` in `@nestri/core`.
+
+## Key details
+
+- Signing keys are generated at runtime and persisted in the `AuthStorage` KV namespace.
+- JWT subjects are defined in `@nestri/core/auth/subjects`.
+- The API worker calls this worker via a service binding (`AUTH`), verified through `AUTH_ISSUER_URL`.
+
+## Structure
+
+```text
+src/index.ts      # Worker entrypoint: issuer config + success callbacks (steam, ssh)
+test/             # Worker tests
+```
+
+## Running
+
+Deployed through Alchemy (`apps/auth` worker in `alchemy.run.ts` at the repo root) with bindings
+`AuthStorage` (KV), `HYPERDRIVE` (Postgres), `STEAM_API_KEY`, `SSH_AUTH_KEY`.