feat: switch oidc client to confidential (backend token exchange)

The provisioned IdP client (https://auth.forgecore.work) is confidential
rather than public/PKCE-only, so a client secret must never reach the
browser. The frontend now only performs the Authorization Code + PKCE
redirect itself (hand-rolled PKCE, oidc-client-ts dependency removed)
and hands the resulting code + verifier to a new, intentionally
unauthenticated POST /api/v1/auth/session endpoint, which performs the
code-for-tokens exchange server-side using OIDC_CLIENT_SECRET and
returns only {accessToken, expiresIn} — refresh_token/id_token are
never forwarded to the client.

New required backend env vars: OIDC_CLIENT_ID, OIDC_CLIENT_SECRET.
Added frontend/proxy.conf.json so the Angular dev server forwards
/api and /health to the local API without needing CORS.

backend/libs/auth/src/auth.module.ts

@@ -2,11 +2,17 @@ import { Global, Module } from '@nestjs/common';
 import { UsersLibModule } from '../../users/src';
 import { OidcDiscoveryService } from './oidc-discovery.service';
 import { OidcAuthGuard } from './oidc-auth.guard';
+import { TokenExchangeService } from './token-exchange.service';
 
 @Global()
 @Module({
   imports: [UsersLibModule],
-  providers: [OidcDiscoveryService, OidcAuthGuard],
-  exports: [OidcDiscoveryService, OidcAuthGuard, UsersLibModule],
+  providers: [OidcDiscoveryService, OidcAuthGuard, TokenExchangeService],
+  exports: [
+    OidcDiscoveryService,
+    OidcAuthGuard,
+    TokenExchangeService,
+    UsersLibModule,
+  ],
 })
 export class AuthModule {}