docs consolidation

docs/modules/authority/architecture.md

@@ -228,7 +228,7 @@ Services **must** verify `aud` and **sender constraint** (DPoP/mTLS) per their p
 ## 5) Storage & state
 
 * **Configuration DB** (PostgreSQL/MySQL): clients, audiences, role→scope maps, tenant/installation registry, device code grants, persistent consents (if any).
-* **Cache** (Redis):
+* **Cache** (Valkey):
 
   * DPoP **jti** replay cache (short TTL)
   * **Nonce** store (per resource server, if they demand nonce)
@@ -375,8 +375,8 @@ authority:
           enabled: true
           ttl: "00:10:00"
           maxIssuancePerMinute: 120
-          store: "redis"
-          redisConnectionString: "redis://authority-redis:6379?ssl=false"
+          store: "valkey"  # uses redis:// protocol
+          valkeyConnectionString: "redis://authority-valkey:6379?ssl=false"
           requiredAudiences:
             - "signer"
             - "attestor"
@@ -428,7 +428,7 @@ authority:
 * **RBAC**: scope enforcement per audience; over‑privileged client denied.
 * **Rotation**: JWKS rotation while load‑testing; zero‑downtime verification.
 * **HA**: kill one Authority instance; verify issuance continues; JWKS served by peers.
-* **Performance**: 1k token issuance/sec on 2 cores with Redis enabled for jti caching.
+* **Performance**: 1k token issuance/sec on 2 cores with Valkey enabled for jti caching.
 
 ---
 
@@ -448,9 +448,9 @@ authority:
 ## 17) Deployment & HA
 
 * **Stateless** microservice, containerized; run ≥ 2 replicas behind LB.
-* **DB**: HA Postgres (or MySQL) for clients/roles; **Redis** for device codes, DPoP nonces/jtis.
+* **DB**: HA Postgres (or MySQL) for clients/roles; **Valkey** for device codes, DPoP nonces/jtis.
 * **Secrets**: mount client JWKs via K8s Secrets/HashiCorp Vault; signing keys via KMS.
-* **Backups**: DB daily; Redis not critical (ephemeral).
+* **Backups**: DB daily; Valkey not critical (ephemeral).
 * **Disaster recovery**: export/import of client registry; JWKS rehydrate from KMS.
 * **Compliance**: TLS audit; penetration testing for OIDC flows.
 
@@ -459,7 +459,7 @@ authority:
 ## 18) Implementation notes
 
 * Reference stack: **.NET 10** + **OpenIddict 6** (or IdentityServer if licensed) with custom DPoP validator and mTLS binding middleware.
-* Keep the DPoP/JTI cache pluggable; allow Redis/Memcached.
+* Keep the DPoP/JTI cache pluggable; allow Valkey/Memcached.
 * Provide **client SDKs** for C# and Go: DPoP key mgmt, proof generation, nonce handling, token refresh helper.
 
 ---