feat: add OIDC sign-in, roles, sessions and client address rule

Authorization-code flow with PKCE through an idp adapter (with a fake), ID
token validation, identity and roles resolved from the directory with a short
cache, refusal of unknown, disabled and locked accounts with one generic page,
sessions that end when the account becomes unavailable, sign-out that ends the
server-side session, role decorators and the trusted-proxy client address rule.
Adds the OIDC_* and PUBLIC_BASE_URL configuration.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

portal/tests/conftest.py

@@ -1,5 +1,11 @@
+from types import SimpleNamespace
+
 import pytest
 
+from portal.adapters import registry
+from portal.adapters.directory import FakeDirectory
+from portal.adapters.idp import FakeIdp
+
 
 @pytest.fixture
 def valid_env(tmp_path):
@@ -16,4 +22,17 @@ def valid_env(tmp_path):
         "LDAP_CA_FILE": str(ca_file),
         "LDAP_PUBLISHER_GROUP_DN": "CN=Publishers,OU=Users,DC=example,DC=test",
         "LDAP_ADMIN_GROUP_DN": "CN=Admins,OU=Users,DC=example,DC=test",
+        "OIDC_ISSUER": "https://idp.example.test/application/o/portal/",
+        "OIDC_CLIENT_ID": "portal-client",
+        "OIDC_CLIENT_SECRET": "client-secret",
+        "PUBLIC_BASE_URL": "https://portal.example.test",
     }
+
+
+@pytest.fixture(autouse=True)
+def adapters():
+    """Fakes for every adapter, so no test can reach a real directory or provider."""
+    fakes = SimpleNamespace(directory=FakeDirectory(), idp=FakeIdp())
+    registry.install(fakes.directory, fakes.idp)
+    yield fakes
+    registry.install()