fix(ci): text=auto catch-all for line endings, and qualify the genrsa pitfall

[EsTharian]

Closes #363
Closes #364

Two small operator-facing corrections from documentation-findings.md, kept in one PR because
each is a few lines and neither touches runtime code.

fix(ci) — .gitattributes line endings (#363)

.gitattributes forced text eol=lf for eight extensions and nothing else. Every text type
added since — *.tsx, *.mjs, *.mts, *.astro, *.mdx, *.css, *.sql, *.toml, *.rs —
fell through it. On a checkout with core.autocrlf=true (the Windows default) those land CRLF
against LF blobs, and both prettier --check and the prettier/prettier ESLint rule reject them
with Delete ␍ on lines the developer never touched. git status stays clean throughout, because
checkout normalisation introduced the CRLF rather than an edit — so the failure carries no diff to
explain itself. CI runs ubuntu-latest and never reproduces it.

The enumeration is the bug, not the four missing entries. The list was correct when written and
rotted as the tree grew; * text=auto eol=lf cannot rot the same way. That is the option #363 asks
to consider, and it is the one taken here. Binary types are marked explicitly rather than left to
detection, and pnpm-lock.yaml is marked generated.

Verification — the exact check-attr evidence from the issue, inverted:

$ git check-attr text eol -- apps/developer-portal/src/client.tsx
apps/developer-portal/src/client.tsx: text: auto     # was: unspecified
apps/developer-portal/src/client.tsx: eol: lf        # was: unspecified

git add --renormalize . produced no changes — committed blobs were already LF, as the issue
records — so there is no renormalisation commit to review.

docs(config) — the genrsa PKCS#1 pitfall (#364)

docs/oidf-op-certification-runbook.md:44 and .env.example:226 both warned that openssl genrsa
emits PKCS#1. Untrue since OpenSSL 3.0. Verified locally on 3.6.3:

$ openssl genrsa 2048 | head -1               → -----BEGIN PRIVATE KEY-----
$ openssl genrsa -traditional 2048 | head -1  → -----BEGIN RSA PRIVATE KEY-----

The underlying requirement is unchanged and still stated plainly: private keys MUST be PKCS#8
(key-management.ts calls importPKCS8 directly), openssl genpkey stays the recommendation
because it emits PKCS#8 on every version, and the pkcs8 -topk8 -nocrypt conversion recipe
stays for anyone holding a PKCS#1 key. Only the version-free claim is corrected.

Note

#364's third task — "check whether any other doc repeats it" — is satisfied for main
(grep -rn genrsa finds only these two). But #389 introduces three new occurrences on its
branch: apps/docs-site/src/content/docs/operate/keys.md states the version split correctly,
while operate/docker.md:55, docker.md:512 and apps/auth-server/src/openapi-export.ts:55
still carry the unqualified claim. Those want a follow-up commit on #389 before it merges —
flagging rather than editing a PR that is already under review.

Testing

• nx run-many -t test typecheck lint -p server-federation — clean
• git check-attr verified above; git add --renormalize . is a no-op
• Not verified on a Windows checkout with core.autocrlf=true — no Windows machine here. The
  check-attr output is the mechanism the issue identifies, so this is the right fix, but the
  end-to-end confirmation in fix(ci): .gitattributes omits .tsx/.mjs/.astro/.css, so lint fails locally on Windows with CRLF errors #363's third task remains unrun.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TopYtHXg4tTs3B2xasjNQR

[netlify]

✅ Deploy Preview for qauth-docs ready!

Name	Link
🔨 Latest commit	c6e8917
🔍 Latest deploy log	https://app.netlify.com/projects/qauth-docs/deploys/6a8e9c3a105bc400080dd204
😎 Deploy Preview	https://deploy-preview-392--qauth-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.