feat: add OIDC sign-in, roles, sessions and client address rule

Authorization-code flow with PKCE through an idp adapter (with a fake), ID
token validation, identity and roles resolved from the directory with a short
cache, refusal of unknown, disabled and locked accounts with one generic page,
sessions that end when the account becomes unavailable, sign-out that ends the
server-side session, role decorators and the trusted-proxy client address rule.
Adds the OIDC_* and PUBLIC_BASE_URL configuration.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

portal/accounts/middleware.py

@@ -1,9 +1,14 @@
-"""Absolute session limit; the idle limit is SESSION_COOKIE_AGE with save-every-request."""
+"""Session limits, client address and the signed-in user.
+
+The idle limit is SESSION_COOKIE_AGE with save-every-request; the absolute limit is below.
+"""
 
 import time
 
 from django.conf import settings
 
+from . import identity
+from .clientip import client_ip, parse_networks
 from .session_store import CREATED_AT
 
 
@@ -18,3 +23,30 @@ class AbsoluteSessionLimitMiddleware:
             # flush() deletes the row; the empty session makes SessionMiddleware clear the cookie.
             session.flush()
         return self.get_response(request)
+
+
+class ClientIpMiddleware:
+    """Set request.client_ip from the peer and, behind a trusted proxy, X-Forwarded-For (AD-7)."""
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+        self.trusted = parse_networks(settings.TRUSTED_PROXIES)
+
+    def __call__(self, request):
+        request.client_ip = client_ip(
+            request.META.get("REMOTE_ADDR", ""),
+            request.META.get("HTTP_X_FORWARDED_FOR", ""),
+            self.trusted,
+        )
+        return self.get_response(request)
+
+
+class CurrentUserMiddleware:
+    """Set request.portal_user: the signed-in user with roles, or None (AD-5)."""
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        request.portal_user = identity.current(request)
+        return self.get_response(request)