Phase 1 complete

.env.example

@@ -6,6 +6,9 @@ JWT_SECRET=your_jwt_secret_key_min_32_chars
 JWT_EXPIRES_IN=1h
 JWT_REFRESH_EXPIRES_IN=7d
 
+# Frontend URL (for OAuth redirects)
+FRONTEND_URL=http://localhost:5173
+
 # LLM Configuration
 LLM_PROVIDER=openrouter
 LLM_API_KEY=sk-or-v1-...
@@ -28,6 +31,9 @@ KEYCLOAK_REALM=dreamchat
 KEYCLOAK_CLIENT_ID=dreamchat-backend
 KEYCLOAK_CLIENT_SECRET=your_keycloak_secret
 
+# Keycloak OAuth redirect URI (must match Keycloak client configuration)
+KEYCLOAK_REDIRECT_URI=http://localhost:3000/api/auth/keycloak/callback
+
 # Keycloak Authorization Settings
 # Require specific group/role/attribute for access
 # Set at least one of these to enforce authorization checks