feat(oidc): a Serverpod module for signing in with OpenID Connect, SimpleLogin a preset (ADR 0023)

halkyon_oidc_server and its generated client halkyon_oidc_client: any
provider following OpenID Connect's code flow, beside Serverpod's own
providers, with a preset for SimpleLogin (no PKCE, no `typ`). Nothing
of Halkyon's is in it; BSD-3-Clause, `publish_to: none` for now.

- Attempts in `halkyon_oidc_attempt` (ADR 0020's D13): the ID
  PostgreSQL's gen_random_uuid(), a state and a nonce of 32 random
  bytes, PKCE's verifier where used, the caller if signed in; ten
  minutes, taken once. A host may begin the state with a marker.
- The code exchanged by the module itself, so a provider out of reach
  (a timeout, a 5xx) is told apart from a refused code; the ID token
  checked with dart_jsonwebtoken's algorithms (ADR 0020's D12): the
  provider's algorithms alone, the key its `kid` names, of the right
  type; issuer, audience and `azp`, expiry, time issued, `nbf`, a
  minute's leeway; the attempt's nonce; a `sub`.
- Keys kept an hour, fetched again for an unknown `kid` at most once
  a minute; discovery checked against the issuer; every request with
  a timeout.
- Identities in `halkyon_oidc_identity`: the provider's key and the
  `sub`, one per person and provider, deleted with the person.
- The stock endpoint (`OidcIdpBaseEndpoint`), and the parts for a host
  with rules of its own: begin, verify, keep and takeKept, link,
  accountOf, unlink; merging people; a limit per network.
- The forwarding page, moved here from halkyon_base in the next commit.

The package's main library is the code generator's, as halkyon_base's;
a host imports `package:halkyon_oidc_server/oidc.dart`. ADR 0023's
point 5 no longer names OAuth2PkceUtil, which the module doesn't use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_oidc_server/config/generator.yaml

@@ -0,0 +1,7 @@
+type: module
+# The name its endpoints have in a host's client (`client.oidc.…`); a host may
+# choose another in its own generator.yaml.
+nickname: oidc
+
+client_package_path: ../halkyon_oidc_client
+server_test_tools_path: test/integration/test_tools

packages/halkyon_oidc_server/config/test.yaml

@@ -0,0 +1,40 @@
+# The module's test server: every port 0, so the tests find free ones and can run
+# side by side. The database is the embedded PostgreSQL Serverpod starts and
+# manages itself (`dataPath`): no Docker needed, `dart test` is enough. Its password
+# and the tests' other secrets are in config/passwords.yaml (git-ignored; see the
+# README for the keys).
+
+apiServer:
+  port: 0
+  publicHost: localhost
+  publicPort: 0
+  publicScheme: http
+
+insightsServer:
+  port: 0
+  publicHost: localhost
+  publicPort: 0
+  publicScheme: http
+
+webServer:
+  port: 0
+  publicHost: localhost
+  publicPort: 0
+  publicScheme: http
+
+database:
+  host: localhost
+  port: 9090
+  name: halkyon_oidc_test
+  user: postgres
+  dataPath: .serverpod/test/pgdata
+
+redis:
+  enabled: false
+  host: localhost
+  port: 9091
+
+# Session logs are never kept, for privacy, as on every Halkyon server.
+sessionLogs:
+  persistentEnabled: false
+  consoleEnabled: true