feat(CIE): Implement OIDC RP Service with login, callback, and session management

docs/API_SPEC.md

@@ -35,6 +35,16 @@ Authorization: Bearer <token>
   sends OTP through Mailpit
 - `POST /auth/otp/verify`
   consumes OTP, returns bearer token
+- `POST /auth/cie/start`
+  starts local demo CIE OIDC RP login flow, returns provider `authorization_url`
+  current demo scope: `openid cie_demo`
+- `GET /auth/cie/callback`
+  OIDC redirect URI for provider callback, backend completes token + userinfo flow then redirects frontend
+- `GET /auth/cie/session/{state}`
+  frontend polling endpoint for OIDC login result
+  returns public `status` in `pending | authenticated | failed`
+  internal RP phase exposed separately as `phase`
+  `auth` payload is present only on success
 - `GET /me`
   current user profile, roles, permissions, points
 - `PATCH /me`