feat: add OIDC sign-in, roles, sessions and client address rule

Authorization-code flow with PKCE through an idp adapter (with a fake), ID
token validation, identity and roles resolved from the directory with a short
cache, refusal of unknown, disabled and locked accounts with one generic page,
sessions that end when the account becomes unavailable, sign-out that ends the
server-side session, role decorators and the trusted-proxy client address rule.
Adds the OIDC_* and PUBLIC_BASE_URL configuration.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

portal/adapters/idp/__init__.py

@@ -0,0 +1,16 @@
+"""Identity-provider adapter: the only code that talks OIDC (AD-1)."""
+
+from .base import Flow, Identity, Idp, IdpError, IdpUnavailable, LoginRejected
+from .fake import FakeIdp
+from .oidc import OidcIdp
+
+__all__ = [
+    "FakeIdp",
+    "Flow",
+    "Identity",
+    "Idp",
+    "IdpError",
+    "IdpUnavailable",
+    "LoginRejected",
+    "OidcIdp",
+]