feat: switch oidc client to confidential (backend token exchange)

The provisioned IdP client (https://auth.forgecore.work) is confidential
rather than public/PKCE-only, so a client secret must never reach the
browser. The frontend now only performs the Authorization Code + PKCE
redirect itself (hand-rolled PKCE, oidc-client-ts dependency removed)
and hands the resulting code + verifier to a new, intentionally
unauthenticated POST /api/v1/auth/session endpoint, which performs the
code-for-tokens exchange server-side using OIDC_CLIENT_SECRET and
returns only {accessToken, expiresIn} — refresh_token/id_token are
never forwarded to the client.

New required backend env vars: OIDC_CLIENT_ID, OIDC_CLIENT_SECRET.
Added frontend/proxy.conf.json so the Angular dev server forwards
/api and /health to the local API without needing CORS.

compose.yml

@@ -30,6 +30,8 @@ services:
       REDIS_URL: "redis://redis:6379"
       OIDC_ISSUER: "${OIDC_ISSUER}"
       OIDC_AUDIENCE: "${OIDC_AUDIENCE}"
+      OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}"
+      OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}"
       APP_VERSION: "${APP_VERSION:-dev}"
       TEAMCITY_BUILD_NUMBER: "${TEAMCITY_BUILD_NUMBER:-local}"
       SOURCE_REVISION: "${SOURCE_REVISION:-local}"
@@ -57,6 +59,8 @@ services:
       REDIS_URL: "redis://redis:6379"
       OIDC_ISSUER: "${OIDC_ISSUER}"
       OIDC_AUDIENCE: "${OIDC_AUDIENCE}"
+      OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}"
+      OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}"
       APP_VERSION: "${APP_VERSION:-dev}"
       TEAMCITY_BUILD_NUMBER: "${TEAMCITY_BUILD_NUMBER:-local}"
       SOURCE_REVISION: "${SOURCE_REVISION:-local}"