feat: Integrate CIE authentication flow

docs/DATABASE_SCHEMA.md

@@ -11,6 +11,8 @@ Schema truth is `migrations/*.sql`. This file is compact human map of current DB
   notifications, moderation flags, reward uniqueness
 - `007_reference_data_and_intervention_links.sql`
   category-to-team-category mapping, public intervention links
+- `011_cie_auth_bridge.sql`
+  lightweight CIE bridge sessions and external identity links
 
 ## Core Auth Tables
 - `users`
@@ -23,6 +25,10 @@ Schema truth is `migrations/*.sql`. This file is compact human map of current DB
   OTP flow, hashed codes, expiry, consumption
 - `api_tokens`
   bearer token hashes, expiry, revocation
+- `cie_auth_sessions`
+  frontend-visible CIE login state, final issued token, expiry
+- `user_external_identities`
+  links local users to external providers using `provider + issuer + subject`
 
 ## Reference Data
 - `report_categories`