Fix Swagger server URLs to use correct hosts

Co-authored-by: Junie <junie@jetbrains.com>

PROGRESS.md

@@ -4,6 +4,17 @@ Source of truth for current development state.
 ---
 All phases complete. **v1.0.0 tagged.** All packages pass `go test ./...`; `golangci-lint run ./...` clean (pre-existing warnings only).
 
+### 2026-03-15 — Fix Swagger server URLs
+
+**Task:** Update Swagger `servers` section to use correct auth server URLs.
+
+**Changes:**
+- `openapi.yaml` and `web/static/openapi.yaml`: replaced `https://auth.example.com:8443` with `https://mcias.metacircular.net:8443` (Production) and `https://localhost:8443` (Local test server).
+
+**Verification:** `go build ./...`, `go test ./...`, `golangci-lint run ./...` all clean.
+
+---
+
 ### 2026-03-15 — Fix /docs Swagger UI (bundle assets locally)
 
 **Problem:** `/docs` was broken because `docs.html` loaded `swagger-ui-bundle.js` and `swagger-ui.css` from `unpkg.com` CDN, which is blocked by the server's `Content-Security-Policy: default-src 'self'` header.

openapi.yaml

@@ -14,8 +14,10 @@ info:
     10 requests per second per IP, burst of 10.
 
 servers:
-  - url: https://auth.example.com:8443
+  - url: https://mcias.metacircular.net:8443
     description: Production
+  - url: https://localhost:8443
+    description: Local test server
 
 components:
   securitySchemes:

web/static/openapi.yaml

@@ -14,8 +14,10 @@ info:
     10 requests per second per IP, burst of 10.
 
 servers:
-  - url: https://auth.example.com:8443
+  - url: https://mcias.metacircular.net:8443
     description: Production
+  - url: https://localhost:8443
+    description: Local test server
 
 components:
   securitySchemes: