Open source alternatives to Auth0

You are a senior full-stack engineer. Build a minimal, self-hosted clone of Auth0 (auth) that I can run on my own VPS. Keep it small, production-sane, and easy to maintain.

## Goal
Replace my paid Auth0 subscription for a single person or small team. MVP only — no billing, no enterprise features.

## Core features (build exactly these)
1. hosted login page (email+password, magic link, OAuth Google/GitHub)
2. OIDC provider endpoints for your apps
3. MFA via TOTP
4. user management admin UI
5. JWT issuance with JWKS

## Stack
- Next.js (App Router, TypeScript) + Tailwind + shadcn/ui
- PostgreSQL with Drizzle ORM (migrations checked in)
- Auth: Better Auth (email + password, optional GitHub OAuth); every query scoped to the signed-in user/workspace
- Background jobs (if needed): pg-boss on the same Postgres
- File storage (if needed): S3-compatible (MinIO container)

## Data model (start here, extend only if required)
User, Application, Session, Identity, MFAFactor, SigningKey
Use UUID primary keys, createdAt/updatedAt on every table, and foreign keys with sensible ON DELETE behavior.

## Deliverables
1. Working app with the features above and a clean, minimal UI
2. docker-compose.yml with app, postgres and Caddy (automatic HTTPS) — `docker compose up -d` must be all I run
3. .env.example documenting every variable; no secrets in code
4. Seed script with demo data
5. README: local dev, deploy on a fresh Ubuntu VPS (install Docker, set DNS A record, compose up), backups (pg_dump cron), and updating

## Rules
- Build in small steps; after each feature, run typecheck and the app, and fix errors before moving on
- Validate all input with zod; rate-limit public endpoints
- Write a few Playwright smoke tests for the main flow
- Ask me before adding any dependency beyond the stack above

For reference (study the approach, don't copy code): https://github.com/supertokens/supertokens-core, https://github.com/keycloak/keycloak, https://github.com/zitadel/zitadel