feat(frontend): server-side Zitadel OIDC auth (part 2)

Add Authorization Code + PKCE login/logout against Zitadel, handled entirely
server-side with an httpOnly signed session cookie:
- $lib/server/auth: openid-client discovery (config cached), jose-signed
  session encode/decode, cookie/name constants
- routes: /login (builds the authorize URL with PKCE/state/nonce, ?mode=register
  -> prompt=create), /auth/callback (code exchange + session cookie),
  /logout (clears session + Zitadel end_session)
- hooks.server populates locals.user/accessToken from the session
- +layout.server exposes the user; Navbar shows the signed-in user + Salir,
  or Iniciar sesión / Registrarse
- switch to adapter-node; env-driven config (.env gitignored, .env.example
  committed) with issuer http://host.docker.internal:8080

Verified: svelte-check + build clean; dev smoke test shows the landing in the
logged-out state and /login issuing a 302 to Zitadel's authorize endpoint with
PKCE/state/nonce (discovery reachable). Real client id/secret still needed to
complete the token exchange.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/server/auth.ts

@@ -0,0 +1,66 @@
+import * as client from 'openid-client';
+import { SignJWT, jwtVerify } from 'jose';
+import { env } from '$env/dynamic/private';
+import type { SessionUser } from '$lib/types';
+
+export const SESSION_COOKIE = 'mf_session';
+export const STATE_COOKIE = 'mf_oidc_state';
+export const VERIFIER_COOKIE = 'mf_oidc_verifier';
+export const NONCE_COOKIE = 'mf_oidc_nonce';
+export const RETURN_COOKIE = 'mf_oidc_return';
+
+export interface Session extends SessionUser {
+	accessToken: string;
+	refreshToken?: string;
+	idToken?: string;
+	expiresAt: number;
+}
+
+export const OIDC_SCOPE = 'openid profile email offline_access';
+
+let configPromise: Promise<client.Configuration> | null = null;
+
+export function getOidcConfig(): Promise<client.Configuration> {
+	configPromise ??= (async () => {
+		const issuer = new URL(env.ZITADEL_ISSUER);
+		const options =
+			issuer.protocol === 'http:' ? { execute: [client.allowInsecureRequests] } : undefined;
+		return client.discovery(
+			issuer,
+			env.ZITADEL_CLIENT_ID,
+			env.ZITADEL_CLIENT_SECRET,
+			undefined,
+			options
+		);
+	})();
+	return configPromise;
+}
+
+export const authConfig = {
+	get redirectUri() {
+		return env.AUTH_REDIRECT_URI;
+	},
+	get postLogoutUri() {
+		return env.AUTH_POST_LOGOUT_URI;
+	}
+};
+
+const sessionKey = () => new TextEncoder().encode(env.SESSION_SECRET);
+
+export async function encodeSession(session: Session): Promise<string> {
+	return new SignJWT({ ...session })
+		.setProtectedHeader({ alg: 'HS256' })
+		.setIssuedAt()
+		.setExpirationTime('7d')
+		.sign(sessionKey());
+}
+
+export async function decodeSession(token: string | undefined): Promise<Session | null> {
+	if (!token) return null;
+	try {
+		const { payload } = await jwtVerify(token, sessionKey());
+		return payload as unknown as Session;
+	} catch {
+		return null;
+	}
+}