feat: add OIDC tables and update federation cache for improved token management

docs/DATABASE_SCHEMA.md

@@ -107,3 +107,15 @@ Schema truth is `migrations/*.sql`. This file is compact human map of current DB
 - No route-optimization/routing tables
 - No audit table for intervention link access beyond `last_accessed_at`
 - Containment check for admin area polygons is simple vertex-inside check
+
+## OIDC Tables
+- `oidc_authentications`
+  login transaction state, provider snapshot, callback/result lifecycle
+- `oidc_authentication_tokens`
+  authorization code and tokens tied to `oidc_authentications`
+- `oidc_federation_cache`
+  cached federation documents with expiry; uniqueness enforced by generated
+  SHA-256 `cache_key` over `(document_type, issuer, subject, fetch_url)` to stay
+  within MySQL index limits
+- `user_external_identities`
+  external provider subject linkage and merged claims snapshot

migrations/011_oidc_rp_foundation.sql

@@ -67,16 +67,19 @@ CREATE TABLE IF NOT EXISTS oidc_federation_cache (
     issuer VARCHAR(255) NOT NULL,
     subject VARCHAR(255) NULL,
     fetch_url VARCHAR(500) NOT NULL,
+    cache_key BINARY(32) GENERATED ALWAYS AS (
+        UNHEX(
+            SHA2(
+                JSON_ARRAY(document_type, issuer, subject, fetch_url),
+                256
+            )
+        )
+    ) STORED,
     payload_json JSON NOT NULL,
     expires_at DATETIME NOT NULL,
     created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
     updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-    UNIQUE KEY oidc_federation_cache_unique (
+    UNIQUE KEY oidc_federation_cache_unique (cache_key),
-        document_type,
-        issuer,
-        subject,
-        fetch_url
-    ),
     KEY oidc_federation_cache_expires_idx (expires_at)
 );