docs: add CLAUDE.md agent guidelines for express-openid-connect

[jd3vi1]

Summary

Adds AI-agent guidelines for express-openid-connect — a lean, guardrail-first CLAUDE.md plus a thin AGENTS.md that points to it, generated by the generating-claude-md skill and validated against the repo.

• CLAUDE.md (157 lines) — persona, working principles, project overview/structure, three-tier Boundaries, Security, and one-line anchors into references/.
• AGENTS.md — imports @./CLAUDE.md so non-Claude tools (Codex CLI, Gemini CLI) share the same guidance.
• references/*.md — full detail offloaded on demand: commands, testing, code-style, git-workflow, pitfalls, docs-update.

What detection surfaced (express-openid-connect specific)

• Express OIDC Relying Party middleware (CommonJS, openid-client v6, jose, joi) — persona reflects an SDK engineer treating the lib/config.js Joi schema and index.js exports as the public contract, with session/cookie and OIDC-flow correctness front of mind.
• Auth0-Client telemetry header (base64 {name,version,env}, set in lib/client.js / lib/context.js, opt-out via enableTelemetry) → Always-Do boundary scoped to new outbound OIDC request paths through createCustomFetch, preserving the opt-out.
• No live-tenant test tier — the default npm run test suite is unit-only (test/setup.js disables outbound network via nock); the slower end-to-end/ tier runs Puppeteer against a local oidc-provider with test-only creds, so there's no Ask-First credentialed-test rule.
• Security posture — default response_type: id_token (Implicit + Form Post), PKCE/state/nonce on the code flow via openid-client, RS256 default (none rejected), encrypted httpOnly session cookies (lib/appSession.js + lib/crypto.js), secrets from env → in Security, not the persona.
• Hand-written index.d.ts + .version — types and version sources that drift easily → keep-in-sync boundaries and a pitfall.
• Code-to-docs mapping (library shape) — config options and exports mapped to README.md / EXAMPLES.md / examples/ / index.d.ts; CHANGELOG.md and the version-specific migration guides intentionally not tracked.
• Prettier + ESLint (singleQuote, printWidth: 80, unix line endings) enforced via a pretty-quick pre-commit hook + CI lint → CI-enforced style guardrail.

Validation

Filesystem validation pass: every cited path, every package.json script / CI job, and every references/*.md pointer (6/6) verified to exist in the repo — no invented tooling.

Generated by the generating-claude-md skill.