Add the service-to-service module

service-to-service/docs/output/01-user-token.txt

@@ -0,0 +1,26 @@
+==============================================================================
+docs/output/01-user-token.txt
+A complete authorization_code + PKCE flow, driven by curl. No browser, no OIDC library.
+scripts/user-token.sh, then scripts/claims.sh
+==============================================================================
+
+{
+  "alg": "RS256",
+  "kid": "<uuid>"
+}
+{
+  "aud": "downstream-api",
+  "exp": <epoch>,
+  "iat": <epoch>,
+  "iss": "http://127.0.0.1:9000",
+  "jti": "<uuid>",
+  "nbf": <epoch>,
+  "scope": [
+    "orders.write",
+    "orders.read"
+  ],
+  "sub": "alice"
+}
+
+# sub is the human. scope is what the human consented to. aud names the service the
+# token was minted for - chapter 4 is about whether anybody looks at it.