feat: fully backend-driven OIDC session flow (session cookie, not bearer token)

Replace the hybrid flow (frontend PKCE + POST /auth/session token
exchange, access token in sessionStorage) with a classic backend-driven
BFF: the browser only ever navigates to GET /api/v1/auth/login and is
redirected straight to the IdP; PKCE verifier/state live server-side in
Redis (SessionStoreService); GET /api/v1/auth/callback (now the
registered IdP redirect URI, replacing the frontend's /auth/callback
route, which is deleted) verifies the id_token, JIT-provisions the
user, creates a Redis-backed session, and sets one httpOnly SameSite=Lax
cookie before redirecting into the app. No token material of any kind
ever reaches the browser.

OidcAuthGuard (per-request bearer JWT verification) is replaced by
SessionAuthGuard (cookie -> Redis session lookup) across every
controller that used it. cookie-parser is now wired into main.ts.

Frontend AuthService shrinks to login()/logout()/ensureSessionChecked();
pkce.ts, auth.interceptor.ts, and the callback component/route are all
removed as dead code under this model.

New required env var: APP_BASE_URL (source of truth for the OIDC
redirect_uri and the post-login redirect target).

Verified end-to-end against the real API, Redis, and a mocked IdP:
login redirect shape, callback cookie + redirect, state-replay
rejection, /users/me 401<->200 around the cookie, and logout.

backend/libs/auth/src/auth.module.ts

@@ -1,17 +1,28 @@
 import { Global, Module } from '@nestjs/common';
+import { RedisModule } from '../../infrastructure/src';
 import { UsersLibModule } from '../../users/src';
 import { OidcDiscoveryService } from './oidc-discovery.service';
-import { OidcAuthGuard } from './oidc-auth.guard';
 import { TokenExchangeService } from './token-exchange.service';
+import { SessionStoreService } from './session-store.service';
+import { SessionAuthGuard } from './session-auth.guard';
+import { AuthFlowService } from './auth-flow.service';
 
 @Global()
 @Module({
-  imports: [UsersLibModule],
-  providers: [OidcDiscoveryService, OidcAuthGuard, TokenExchangeService],
+  imports: [RedisModule, UsersLibModule],
+  providers: [
+    OidcDiscoveryService,
+    TokenExchangeService,
+    SessionStoreService,
+    SessionAuthGuard,
+    AuthFlowService,
+  ],
   exports: [
     OidcDiscoveryService,
-    OidcAuthGuard,
     TokenExchangeService,
+    SessionStoreService,
+    SessionAuthGuard,
+    AuthFlowService,
     UsersLibModule,
   ],
 })