feat: add OIDC sign-in, roles, sessions and client address rule

Authorization-code flow with PKCE through an idp adapter (with a fake), ID
token validation, identity and roles resolved from the directory with a short
cache, refusal of unknown, disabled and locked accounts with one generic page,
sessions that end when the account becomes unavailable, sign-out that ends the
server-side session, role decorators and the trusted-proxy client address rule.
Adds the OIDC_* and PUBLIC_BASE_URL configuration.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

portal/adapters/registry.py

@@ -0,0 +1,31 @@
+"""Where the rest of the portal gets its adapters. Tests install fakes with `install`."""
+
+from __future__ import annotations
+
+from django.conf import settings
+
+from .directory import Directory, LdapDirectory
+from .idp import Idp, OidcIdp
+
+_directory: Directory | None = None
+_idp: Idp | None = None
+
+
+def get_directory() -> Directory:
+    global _directory
+    if _directory is None:
+        _directory = LdapDirectory(settings.DIRECTORY)
+    return _directory
+
+
+def get_idp() -> Idp:
+    global _idp
+    if _idp is None:
+        _idp = OidcIdp(settings.OIDC)
+    return _idp
+
+
+def install(directory: Directory | None = None, idp: Idp | None = None) -> None:
+    """Replace the adapters (tests). Passing None for one leaves it to be built on first use."""
+    global _directory, _idp
+    _directory, _idp = directory, idp