Thin backend connector for logi (1pass) as an identity provider. Confidential-client code exchange with mandatory id_token verification (signature + iss + aud + exp + nonce). Zero gem dependencies (stdlib OpenSSL + net/http).