feat(auth): add SSO with configurable identity providers and social l…

[digmunhoz]

Description

This PR adds SSO (Single Sign-On) with configurable identity providers, allowing users to sign in with OAuth2/OIDC providers such as Google and Microsoft in addition to email/password.

Backend (API):

• New tables identity_providers and user_social_accounts (migration), with optional organization_id on identity providers for future per-organization IdPs
• Encrypted storage of client_secret using existing secrets_crypto module
• Admin-only CRUD for identity providers at /auth/admin/identity-providers (list, create, get, patch, delete)
• Public endpoint GET /auth/identity-providers to list enabled providers for the login page
• OAuth2 flow: GET /auth/{slug}/login (redirect to IdP) and GET /auth/{slug}/callback (exchange code, create/link user, issue JWT, redirect to portal)
• User linking by email; new users created when first signing in via IdP; user_social_accounts links users to provider identities
• All new API responses and auth-related error messages in English

Portal:

• New admin section "Identity Providers" under Administrative (admin only), with list, create/edit modal (provider type: Google, Microsoft, Other; slug derived from name; Google URLs pre-filled), and delete confirmation
• Login page: "Sign in with" plus provider buttons (Google, Microsoft, Other) with icons; layout avoids an unbounded vertical list
• Login callback route /login/callback to handle OAuth redirect and store tokens
• User avatar from IdP (e.g. Google) shown in navbar when available
• Status badges (colored pills) for Identity Providers and Users screens (Enabled/Active, Disabled/Inactive)

Other:

• CORS: added PATCH and explicit OPTIONS handler for identity-provider routes; make lint target runs API (ruff check + format) and Portal (eslint + tsc) as in CI

Related Issue

Closes #54

Type of Change

• ✨ New feature (non-breaking change that adds functionality)
• 🐛 Bug fix (non-breaking change that fixes an issue)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 📚 Documentation update
• 🔧 Refactoring (no functional changes)
• 🧪 Tests (adding or updating tests)
• 🏗️ Infrastructure/CI changes

Component Affected

• API (backend)
• Portal (frontend)
• Documentation
• CI/CD
• Other: Makefile (make lint)

Checklist

General

• I have read the CONTRIBUTING.md guidelines
• My code follows the project's code style
• I have performed a self-review of my code
• I have commented my code in hard-to-understand areas
• My changes generate no new warnings or errors

Testing

• I have added tests that prove my fix/feature works
• New and existing unit tests pass locally with my changes
• I have tested my changes manually

Documentation

• I have updated the documentation accordingly
• I have updated the README if needed

Screenshots (if applicable)

Test Plan

1. Admin – Identity Providers: As admin, open Administrative → Identity Providers, create a provider (e.g. Google) with Client ID/Secret and URLs, enable it, then edit/disable/delete and confirm list and masks behave correctly.
2. Login – SSO: On the login page, confirm enabled providers appear (e.g. "Sign in with Google"); click one, complete IdP flow, and confirm redirect to app and session; confirm avatar appears in navbar when the IdP returns a picture.
3. Login – callback: After IdP redirect, confirm /login/callback receives tokens and redirects to home with user logged in; confirm error handling when state is invalid or provider is disabled.
4. Lint: Run make lint (or make api-lint and make portal-lint) and ensure both API and Portal pass.

Additional Notes

• Environment: For OAuth to work, set API_PUBLIC_URL (e.g. http://localhost:8000) and FRONTEND_URL (e.g. http://localhost:3000) so redirect_uri and post-login redirect are correct. Configure TRON_SECRETS_KEY for encrypting identity provider client secrets.
• Google: Use Google Cloud Console to create OAuth 2.0 credentials and set redirect URI to {API_PUBLIC_URL}/auth/google/callback.
• Model identity_providers has nullable organization_id for future per-organization IdP support.