docs: archive entra materials and simplify deployment docs

scripts/deploy/phase3-identity-secrets.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+#
+# Phase 3: Identity Provider Secrets
+# Manual identity-provider setup, recorded in the local operator secret file.
+#
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/config.sh"
+
+log_info "=========================================="
+log_info "Phase 3: Identity Provider Secrets"
+log_info "=========================================="
+
+SECRETS_FILE="${STATE_DIR}/secrets/${ENVIRONMENT}.env"
+
+log_warning "This phase requires manual identity-provider configuration"
+log_info "See docs/deployment/DEPLOYMENT_GUIDE.md for detailed instructions"
+
+# Check if secrets already exist
+log_step "3.1 Checking for existing identity-provider configuration..."
+
+if [ -f "${SECRETS_FILE}" ]; then
+  # shellcheck source=/dev/null
+  source "${SECRETS_FILE}"
+fi
+
+if [ -n "${OIDC_ISSUER:-}" ] || [ -n "${VC_ISSUER_DID:-}" ] || [ -n "${VC_ISSUER_DOMAIN:-}" ]; then
+  log_success "Identity-provider configuration found in ${SECRETS_FILE}"
+  [ -n "${OIDC_ISSUER:-}" ] && log_info "OIDC issuer: ${OIDC_ISSUER}"
+  [ -n "${VC_ISSUER_DID:-}" ] && log_info "VC issuer DID: ${VC_ISSUER_DID}"
+  [ -n "${VC_ISSUER_DOMAIN:-}" ] && log_info "VC issuer domain: ${VC_ISSUER_DOMAIN}"
+else
+  log_warning "Identity-provider configuration not found"
+  log_info "Please complete manual steps:"
+  log_info "  1. Set OIDC issuer and client details if this environment uses OIDC"
+  log_info "  2. Set VC_ISSUER_DID or VC_ISSUER_DOMAIN for credential issuance"
+  log_info "  3. Store those values in ${SECRETS_FILE}"
+  log_info ""
+fi
+
+# Save state
+save_state "phase3" "manual-steps-required"
+
+log_success "=========================================="
+log_success "Phase 3: Identity Provider Secrets - Manual steps required"
+log_success "=========================================="