feat: Integrate CIE authentication flow

docs/LLM_CONTEXT.md

@@ -31,9 +31,18 @@ public revocable link generated by operator/admin.
 - Registration creates `citizen`.
 - Login path:
   - OTP email via Mailpit
+  - CIE via external `spid-cie-oidc-django` relying party service
 - Auth token: bearer token from `api_tokens`
 - Banned users cannot authenticate.
 
+### CIE Bridge Flow
+1. Frontend calls `POST /api/v1/auth/cie/start`.
+2. Visione creates `cie_auth_sessions.state` and returns Django start URL.
+3. Browser completes CIE login on Django RP service.
+4. Django sends signed payload to `POST /api/v1/auth/cie/exchange`.
+5. Visione finds or creates user, stores `user_external_identities`, issues token.
+6. Frontend polls `GET /api/v1/auth/cie/session/{state}` until `authenticated`.
+
 ## Current Report Workflow
 ### Citizen flow
 1. Register/login.
@@ -116,6 +125,7 @@ public revocable link generated by operator/admin.
 ## Files To Read First
 - `docs/API_SPEC.md`
 - `docs/ARCHITECTURE.md`
+- `docs/CIE_AUTH_INTEGRATION.md`
 - `docs/openapi/visione.openapi.yaml`
 - `controllers/*.h`
 - `services/*.cc`