feat(CIE): Implement OIDC RP Service with login, callback, and session management

docs/ARCHITECTURE.md

@@ -25,6 +25,9 @@ generate public read-only intervention links.
 ## Runtime Model
 - Auth uses bearer tokens from `api_tokens`.
 - OTP login uses `otp_challenges` and Mailpit in local dev.
+- CIE login uses OIDC RP state tables, public federation endpoints under
+  `/oidc/rp/*`, callback-side token exchange, encrypted/signed `userinfo`,
+  and frontend polling on `GET /api/v1/auth/cie/session/{state}`.
 - DB access uses raw parameterized SQL through `drogon::orm::DbClient`.
 - No Drogon generated ORM models. No `Mapper<T>`.
 
@@ -62,6 +65,8 @@ Effective permission helpers:
 ## Main Persistence Objects
 - `users`, `roles`, `permissions`, `user_roles`, `role_permissions`
 - `api_tokens`, `otp_challenges`
+- `oidc_authentications`, `oidc_authentication_tokens`,
+  `oidc_federation_cache`, `user_external_identities`
 - `report_categories`, `areas`, `team_categories`, `teams`
 - `reports`, `report_status_history`, `assignments`, `report_photos`
 - `messages`, `feedback`, `reward_events`, `notifications`
@@ -97,3 +102,6 @@ Output path:
   still exposes citizen phone by design.
 - Allowed-area containment for admin areas is vertex-based, simple not strict GIS-hard.
 - No frontend doc set here beyond API/OpenAPI docs.
+- OIDC federation trust validation/cache is still pragmatic: metadata comes from
+  trust-anchor `resolve`, but full trust-chain cryptographic validation is not
+  implemented yet.