feat: add OIDC sign-in, roles, sessions and client address rule

Authorization-code flow with PKCE through an idp adapter (with a fake), ID
token validation, identity and roles resolved from the directory with a short
cache, refusal of unknown, disabled and locked accounts with one generic page,
sessions that end when the account becomes unavailable, sign-out that ends the
server-side session, role decorators and the trusted-proxy client address rule.
Adds the OIDC_* and PUBLIC_BASE_URL configuration.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3t4WL7bd9bdHHNjEsxzqC

pyproject.toml

@@ -10,6 +10,8 @@ dependencies = [
     "whitenoise>=6.9",
     "tzdata",
     "python-ldap>=3.4.4",
+    "authlib>=1.7,<1.8",
+    "requests>=2.32",
 ]
 
 [dependency-groups]
@@ -37,6 +39,10 @@ env = [
     "LDAP_CA_FILE=pyproject.toml",
     "LDAP_PUBLISHER_GROUP_DN=CN=Publishers,OU=Users,DC=example,DC=test",
     "LDAP_ADMIN_GROUP_DN=CN=Admins,OU=Users,DC=example,DC=test",
+    "OIDC_ISSUER=https://idp.example.test/application/o/portal/",
+    "OIDC_CLIENT_ID=portal-client",
+    "OIDC_CLIENT_SECRET=test-only-client-secret",
+    "PUBLIC_BASE_URL=https://portal.example.test",
 ]
 
 [tool.ruff]