docs: record Source Cooperative's Ory OAuth2 clients

[alukach]

Records the Ory OAuth2 clients each environment uses, so their setup isn't only in Ory and in people's memory.

• Client configuration: adds the Refresh Token grant, which login already relies on.
• New section, Source Cooperative's Ory clients:
  • project IDs, issuers and client IDs for both environments;
  • the source-coop-cli clients, including skip_consent. Both now use jwt access tokens, which feat(api): accept Ory access tokens from the CLI's login source.coop#654 needs;
  • the website's source.coop frontend client and what it's for, so nobody fixes it to match the CLI's;
  • a safe way to change a client. ory update oauth2-client replaces the whole client, and the ory CLI has no patch for clients.

Every value was read from Ory on 2026-10-13.

🤖 Generated with Claude Code

[claude]

Claude finished @alukach's task in 11s —— View job

---

✅ No blocking issues — safe to merge.

This is a docs-only change to README.md. I found no correctness or security problems.

• The IDs listed are project, client and issuer identifiers, not secrets. The frontend's client secret is correctly described as living in Vercel.
• The new Refresh Token grant line matches the existing offline_access scope.
• The ory update oauth2-client change recipe has a rollback step, and it warns that the command replaces the whole client.
• The PR description says production's CLI client is still opaque. The last commit, "both CLI clients now issue JWT access tokens", suggests that has since changed. The README diff has no "still opaque" sentence, so there is nothing stale to remove.

Simplify (ponytail)

• README.md change recipe: the P=... C=... variables and the comment-only rollback line are fine. If the recipe is rarely used, the jq example could be cut and the prose alone kept. This is advisory only.

---

💰 Estimated review cost: $0.08 · 0m10s · 4 turns