The provisioned IdP client (https://auth.forgecore.work) is confidential
rather than public/PKCE-only, so a client secret must never reach the
browser. The frontend now only performs the Authorization Code + PKCE
redirect itself (hand-rolled PKCE, oidc-client-ts dependency removed)
and hands the resulting code + verifier to a new, intentionally
unauthenticated POST /api/v1/auth/session endpoint, which performs the
code-for-tokens exchange server-side using OIDC_CLIENT_SECRET and
returns only {accessToken, expiresIn} — refresh_token/id_token are
never forwarded to the client.
New required backend env vars: OIDC_CLIENT_ID, OIDC_CLIENT_SECRET.
Added frontend/proxy.conf.json so the Angular dev server forwards
/api and /health to the local API without needing CORS.
NestJS resolves a guard referenced via @UseGuards(SomeGuard) using the
consuming module's injector, not the guard's own declaring module's
injector. OidcAuthGuard and TripMembershipGuard are shared across
several feature modules, so every constructor dependency they need
(UsersRepository/UsersService, TripMembersRepository, etc.) must be
re-exported by AuthModule/TripsLibModule/UsersLibModule, not just the
guard classes themselves. Found via the Phase 02 end-to-end smoke test
against a mocked IdP, which failed to boot the API before this fix.
