Per-host SSO: Node auth endpoints + Redis session (#57)

Adds the /__proxy_auth OIDC flow served on every proxied host:
- routes/host_auth.js: /start (PKCE+state, per-host redirect_uri), /callback
  (exchange, enforce the host allow-list via utils/host_sso.identityAllowed,
  mint session + set __proxy_sso cookie), /logout.
- models/sso_session.js: SsoSession (Redis-backed, TTL'd; read directly by the
  Lua gate) and HostSsoState (in-flight auth request).
- utils/oidc.js: per-host redirect_uri override on buildAuthUrl/exchangeCode.
- conf.hostSso (reuses conf.oidc). Allow-list logic unit-tested.

Enforcement (Lua gate + nginx location) lands next.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/app.js

@@ -60,10 +60,15 @@ app.use(express.json());
 app.set('views', path.join(__dirname, 'views'));
 app.set('view engine', 'ejs');
 
+// Per-host SSO endpoints. nginx routes /__proxy_auth/* on every proxied host to
+// the app (see ops/nginx_conf/proxy.conf); these run the OIDC flow and set the
+// per-host session cookie. Mounted before the page router.
+app.use('/__proxy_auth', require('./routes/host_auth'));
+
 // Routes for front end content.
 app.use('/', require('./routes/render'));
 
-// Routes for API 
+// Routes for API
 app.use('/api', require('./routes/api'));
 
 // Catch 404 and forward to error handler. If none of the above routes are