oauth2-authorization-server

The server implements standard Spring Security and OAuth2 Authorization Server best practices. It uses BCrypt for password encoding, handles JWTs, and employs secure cookie settings (Secure, HttpOnly). File uploads to MinIO/S3 generate UUID-based filenames to mitigate path traversal risks. Most sensitive configurations (database, AI keys, MinIO credentials, LDAP) are externalized via environment variables, with sensible defaults provided for local Docker Compose setup. The presence of example weak passwords in `docker-compose.yml` and README setup is noted, but they are clearly intended for local development and are configured for externalization in `application.yml` for production readiness. No 'eval', obfuscation, or explicit malicious patterns were found.