feat: Integrate CIE authentication flow

docs/API_SPEC.md

@@ -35,6 +35,10 @@ Authorization: Bearer <token>
   sends OTP through Mailpit
 - `POST /auth/otp/verify`
   consumes OTP, returns bearer token
+- `POST /auth/cie/start`
+  creates local CIE login state and returns Django RP authorization URL
+- `GET /auth/cie/session/{state}`
+  frontend polling endpoint; returns final Visione bearer token on success
 - `GET /me`
   current user profile, roles, permissions, points
 - `PATCH /me`