feat: add OIDC sign-in, roles, sessions and client address rule

Authorization-code flow with PKCE through an idp adapter (with a fake), ID
token validation, identity and roles resolved from the directory with a short
cache, refusal of unknown, disabled and locked accounts with one generic page,
sessions that end when the account becomes unavailable, sign-out that ends the
server-side session, role decorators and the trusted-proxy client address rule.
Adds the OIDC_* and PUBLIC_BASE_URL configuration.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

portal/templates/accounts/base.html

@@ -0,0 +1,13 @@
+{% load i18n %}<!doctype html>
+<html lang="{{ LANGUAGE_CODE }}">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>{% block title %}{% trans "Self-service portal" %}{% endblock %}</title>
+</head>
+<body>
+<main>
+{% block content %}{% endblock %}
+</main>
+</body>
+</html>

portal/templates/accounts/forbidden.html

@@ -0,0 +1,8 @@
+{% extends "accounts/base.html" %}
+{% load i18n %}
+{% block title %}{% trans "No permission" %}{% endblock %}
+{% block content %}
+<h1>{% trans "No permission" %}</h1>
+<p>{% trans "You do not have permission to open this page." %}</p>
+<p><a href="{% url 'home' %}">{% trans "Back to the portal" %}</a></p>
+{% endblock %}

portal/templates/accounts/home.html

@@ -0,0 +1,11 @@
+{% extends "accounts/base.html" %}
+{% load i18n %}
+{% block title %}{% trans "Welcome" %}{% endblock %}
+{% block content %}
+<h1>{% blocktrans with name=portal_user.display_name %}Signed in as {{ name }}{% endblocktrans %}</h1>
+<p>{{ portal_user.user.sam }}</p>
+<form method="post" action="{% url 'logout' %}">
+  {% csrf_token %}
+  <button type="submit">{% trans "Sign out" %}</button>
+</form>
+{% endblock %}

portal/templates/accounts/refused.html

@@ -0,0 +1,8 @@
+{% extends "accounts/base.html" %}
+{% load i18n %}
+{% block title %}{% trans "Sign-in not possible" %}{% endblock %}
+{% block content %}
+<h1>{% trans "Sign-in not possible" %}</h1>
+<p>{% trans "You cannot sign in to the portal with this account. If you think this is a mistake, contact your administrator." %}</p>
+<p><a href="{% url 'login' %}">{% trans "Try again" %}</a></p>
+{% endblock %}

portal/templates/accounts/signed_out.html

@@ -0,0 +1,7 @@
+{% extends "accounts/base.html" %}
+{% load i18n %}
+{% block title %}{% trans "Signed out" %}{% endblock %}
+{% block content %}
+<h1>{% trans "You have been signed out" %}</h1>
+<p><a href="{% url 'login' %}">{% trans "Sign in again" %}</a></p>
+{% endblock %}

portal/templates/accounts/unavailable.html

@@ -0,0 +1,7 @@
+{% extends "accounts/base.html" %}
+{% load i18n %}
+{% block title %}{% trans "Not available" %}{% endblock %}
+{% block content %}
+<h1>{% trans "Not available" %}</h1>
+<p>{% trans "This is not possible right now. Please try again later." %}</p>
+{% endblock %}