feat: add OIDC sign-in, roles, sessions and client address rule

Authorization-code flow with PKCE through an idp adapter (with a fake), ID
token validation, identity and roles resolved from the directory with a short
cache, refusal of unknown, disabled and locked accounts with one generic page,
sessions that end when the account becomes unavailable, sign-out that ends the
server-side session, role decorators and the trusted-proxy client address rule.
Adds the OIDC_* and PUBLIC_BASE_URL configuration.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

.env.example

@@ -30,6 +30,16 @@ CA_FILE_HOST=
 LDAP_PUBLISHER_GROUP_DN=
 LDAP_ADMIN_GROUP_DN=
 
+# Required. The OpenID provider's application: the issuer address from its OpenID
+# configuration page (keep the trailing slash), client ID and client secret.
+OIDC_ISSUER=
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+
+# Required. The address users reach the portal at (scheme and host only). The sign-in
+# redirect address registered at the provider is this plus /auth/callback.
+PUBLIC_BASE_URL=https://portal.example.test
+
 # Optional. Directory for the database. Default /data (the container volume).
 # DATA_DIR=/data
 
@@ -37,7 +47,7 @@ LDAP_ADMIN_GROUP_DN=
 # DEBUG=false
 
 # Optional. Comma-separated IP addresses or networks of reverse proxies. Default empty.
-# Reserved for the client-IP rule in a later entry; currently has no effect.
+# The portal takes the client address from X-Forwarded-For only when the request comes from one of these.
 # TRUSTED_PROXIES=
 
 # Optional. DEBUG, INFO, WARNING, ERROR or CRITICAL. Default INFO.