feat: Integrate CIE authentication flow

docs/ARCHITECTURE.md

@@ -25,6 +25,10 @@ generate public read-only intervention links.
 ## Runtime Model
 - Auth uses bearer tokens from `api_tokens`.
 - OTP login uses `otp_challenges` and Mailpit in local dev.
+- CIE login uses external Django RP service:
+  - Visione creates local `state`
+  - Django RP completes CIE/OIDC and sends signed identity payload to Visione
+  - Visione creates or links local user, issues `api_tokens`, frontend polls session status
 - DB access uses raw parameterized SQL through `drogon::orm::DbClient`.
 - No Drogon generated ORM models. No `Mapper<T>`.
 
@@ -61,7 +65,7 @@ Effective permission helpers:
 
 ## Main Persistence Objects
 - `users`, `roles`, `permissions`, `user_roles`, `role_permissions`
-- `api_tokens`, `otp_challenges`
+- `api_tokens`, `otp_challenges`, `cie_auth_sessions`, `user_external_identities`
 - `report_categories`, `areas`, `team_categories`, `teams`
 - `reports`, `report_status_history`, `assignments`, `report_photos`
 - `messages`, `feedback`, `reward_events`, `notifications`
@@ -97,3 +101,5 @@ Output path:
   still exposes citizen phone by design.
 - Allowed-area containment for admin areas is vertex-based, simple not strict GIS-hard.
 - No frontend doc set here beyond API/OpenAPI docs.
+- CIE bridge trusts HMAC-signed callback from Django RP service; keep shared
+  secret rotated and never expose it to frontend.