PAIS browser chat example - blog-1.1.0
Adapted from my working two-container lab application, not a vendor PAIS component.
No credentials, private keys, kubeconfigs, internal CA files, or active deployment IDs are included.

Files: public/ static UI; server.mjs Node backend; nginx.conf reverse proxy;
Dockerfile.nginx and Dockerfile.backend; deployment.yaml; service.yaml; auth.test.mjs.

Before deployment:
- Use Node 24 to run node --test auth.test.mjs and node --check public/app.js.
- Build and push both images to your private registry. Replace deployment image references with your own digests.
- Set PUBLIC_ORIGIN, OIDC_CLIENT_ID, OIDC_ISSUER, PAIS_BASE_URL and PAIS_AGENT_ID in deployment.yaml.
- This backend targets the VCFA /oidc issuer and /oauth2/authorize, /oauth2/token, /oauth2/jwks endpoints.
  It validates RS256 ID tokens and is not a generic discovery-driven OIDC client.
- Register the exact PUBLIC_ORIGIN/auth/callback URI on the same public VCFA client used by PAIS; keep PKCE required.
- Create namespace pais-chat, pull Secret harbor-ai-apps, TLS Secret pais-chat-tls, and ConfigMap platform-ca (ca.crt).
- Apply deployment.yaml and service.yaml in the selected application VKS cluster, not Supervisor or the PAIS-managed runtime cluster.
- DNS must point chat hostname at Service EXTERNAL-IP. Check routing, TLS, SSO, streaming, user isolation and history.

Sessions and tokens are memory-only. One replica with Recreate avoids cross-pod session routing; updates interrupt sessions.
There is no token refresh; sign in again after expiration or backend restart.
Conversations are stored in browser localStorage, partitioned by authenticated identity; not encrypted chat storage.
Sign out does not erase saved browser history. Use dedicated browser profiles and clear stored data as appropriate.
Limits: 8,000 recent history characters, 768 requested output tokens, one active response per session.
Health check proves backend reachability only, not IdP/PAIS/model health.
This example needs environment-specific end-to-end validation before use.
