Add OIDC login and per-domain authorization

Authentication previously implied full authorization: any valid token
could manage every host, DNS provider, domain, and user. This adds SSO
login and a per-domain rights model.

OIDC login (authorization_code + PKCE):
- conf.oidc + conf.auth blocks; clientSecret in (gitignored) secrets.js.
- utils/oidc.js (state/PKCE, code exchange, userinfo) using global fetch.
- models/oidc_state.js: short-lived state store, auto-expiring via
  model-redis 1.5 per-key TTL.
- routes/auth.js: GET /auth/oidc/start + /auth/oidc/callback; JIT-provisions
  a local user, mints an AuthToken carrying the SSO groups, hands the token to
  the browser via a URL fragment. "Log in with SSO" button on the login page.

Authorization (groups + app overrides, per-domain, with ownership):
- models/grant.js + utils/roles.js (pure, unit-tested): effective rights from
  conf.auth (admin users/groups, group->role map), Grant records
  (user|group -> global|domain -> viewer|manager|admin), and ownership
  (created_by). Roles rank admin > manager(owner) > viewer.
- AuthToken stores session groups; middleware/auth.js exposes req.groups.
- middleware/authz.js: requireAdmin, requireDomainRole(minRole, resolveDomain),
  filterViewable. Applied across routes: host mutations need manager on the
  host's domain; reads are filtered to visible domains; DNS providers, user
  management, and grant management are global-admin-only; certs need viewer.
- routes/grant.js: admin CRUD for grants. Anti-lockout via conf.auth.adminUsers
  plus migrations/grant_bootstrap.js.

Frontend: /me returns effective rights; nav gates Users/Grants to admins;
grants management page; OIDC token-fragment handling in app-base.js.

Tests: utils/roles and utils/oidc unit-tested (no redis); wired into the test
scripts. Full suite 89 pass. Also verified end-to-end against redis (grant
resolution, middleware allow/deny/403, list filtering) and the OIDC pure flow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/routes/auth.js

@@ -1,7 +1,10 @@
 'use strict';
 
 const router = require('express').Router();
+const conf = require('@simpleworkjs/conf');
 const { Auth } = require('../models/auth');
+const { OidcState } = require('../models/oidc_state');
+const oidc = require('../utils/oidc');
 
 
 router.post('/login', async function(req, res, next){
@@ -29,4 +32,66 @@ router.all('/logout', async function(req, res, next){
 	}
 });
 
+/**
+ * OIDC login start: create a PKCE + state challenge, persist it (auto-expiring
+ * via OidcState TTL), and redirect the browser to the SSO authorize endpoint.
+ */
+router.get('/oidc/start', async function(req, res, next){
+	try{
+		if(!conf.oidc || !conf.oidc.enabled){
+			let error = new Error('OidcDisabled');
+			error.status = 404;
+			error.message = 'OIDC login is not enabled.';
+			throw error;
+		}
+
+		let {state, codeVerifier, codeChallenge} = oidc.createAuthRequest();
+		await OidcState.create({
+			state,
+			codeVerifier,
+			redirect: req.query.redirect || '/',
+		});
+
+		return res.redirect(oidc.buildAuthUrl(state, codeChallenge));
+	}catch(error){
+		next(error);
+	}
+});
+
+/**
+ * OIDC callback: validate state (consuming the one-time record), exchange the
+ * code for tokens, read identity from userinfo, establish a session, and hand
+ * the app token back to the browser via a URL fragment for the login page to
+ * store in localStorage.
+ */
+router.get('/oidc/callback', async function(req, res, next){
+	try{
+		let {code, state} = req.query;
+		if(!code || !state){
+			let error = new Error('OidcCallbackInvalid');
+			error.status = 400;
+			error.message = 'Missing code or state.';
+			throw error;
+		}
+
+		// get() throws if the state is unknown or has expired — this both binds
+		// the callback to our request and bounds replay.
+		let saved = await OidcState.get(state);
+		await saved.remove();
+
+		let tokens = await oidc.exchangeCode(code, saved.codeVerifier);
+		let claims = await oidc.fetchUserInfo(tokens.access_token);
+		let identity = oidc.claimsToIdentity(claims);
+
+		let {token} = await Auth.oidcSession(identity);
+
+		let redirect = saved.redirect || '/';
+		return res.redirect(
+			`/login#token=${encodeURIComponent(token.token)}&redirect=${encodeURIComponent(redirect)}`
+		);
+	}catch(error){
+		next(error);
+	}
+});
+
 module.exports = router;