Module auth 

Soma’s product auth default mapping: the env prefix, session cookie name, supported/default scopes, and resource path that turn soma-auth’s generic, product-agnostic AuthConfigBuilder into Soma’s own OAuth configuration (plan section 3.20).

Moved out of apps/soma/src/runtime.rs (formerly the private soma_mcp_auth_config_builder helper) — this crate is its permanent home per PR 11’s acceptance criterion that apps/soma constructs adapters but contains none of their implementation logic.

Functions

soma_auth_config

Build Soma’s soma_auth::config::AuthConfig from the typed soma_config::AuthConfig — the only supported path for the OAuth runtime.

soma_auth_config_builder

Soma’s default soma_auth::config::AuthConfigBuilder: SOMA_MCP env prefix, soma_mcp_session cookie, the three Soma scopes, soma:read as default scope, /mcp as the OAuth resource path, and dynamic client registration enabled.

soma_auth_env_vars

Synthesize the SOMA_MCP_* var list soma_auth::AuthConfigBuilder expects from typed config fields.