feat: Integrate CIE authentication flow

migrations/011_cie_auth_bridge.sql

@@ -0,0 +1,36 @@
+CREATE TABLE IF NOT EXISTS cie_auth_sessions (
+    id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
+    state VARCHAR(128) NOT NULL,
+    frontend_redirect_uri VARCHAR(500) NOT NULL,
+    status ENUM('PENDING', 'AUTHENTICATED', 'FAILED') NOT NULL DEFAULT 'PENDING',
+    issuer VARCHAR(255) NULL,
+    subject VARCHAR(255) NULL,
+    fiscal_code VARCHAR(16) NULL,
+    authenticated_user_id BIGINT UNSIGNED NULL,
+    result_token VARCHAR(255) NULL,
+    raw_claims JSON NULL,
+    expires_at DATETIME NOT NULL,
+    consumed_at DATETIME NULL,
+    created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    UNIQUE KEY cie_auth_sessions_state_unique (state),
+    KEY cie_auth_sessions_status_idx (status),
+    KEY cie_auth_sessions_expires_idx (expires_at),
+    CONSTRAINT cie_auth_sessions_user_fk FOREIGN KEY (authenticated_user_id) REFERENCES users(id)
+);
+
+CREATE TABLE IF NOT EXISTS user_external_identities (
+    id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
+    user_id BIGINT UNSIGNED NOT NULL,
+    provider VARCHAR(50) NOT NULL,
+    issuer VARCHAR(255) NOT NULL,
+    subject VARCHAR(255) NOT NULL,
+    fiscal_code VARCHAR(16) NOT NULL,
+    raw_claims JSON NULL,
+    created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    UNIQUE KEY user_external_identities_provider_subject_unique (provider, issuer, subject),
+    KEY user_external_identities_user_idx (user_id),
+    KEY user_external_identities_fiscal_code_idx (fiscal_code),
+    CONSTRAINT user_external_identities_user_fk FOREIGN KEY (user_id) REFERENCES users(id)
+);