- Add OidcService: lazy-initialized singleton wrapping oidc-provider v9
  - PostgreSQL adapter (via OidcAdapterService)
  - Configurable TTL, claims, routes, cookie keys
  - findAccount for token introspection
- Add oidcRoutes: mount all OIDC discovery + token endpoints
  - /.well-known/openid-configuration
  - /oauth/authorize, /oauth/token, /oauth/userinfo
  - /oauth/jwks, /oauth/introspect, /oauth/revoke, /oauth/logout
- Add oidcInteractionsController: interactive login/register/consent flows
  - GET /oidc/interaction/:uid — render login or consent page
  - POST /oidc/interaction/:uid/login — validate credentials
  - POST /oidc/interaction/:uid/register — create account
  - POST /oidc/interaction/:uid/confirm — approve consent
  - POST /oidc/interaction/:uid/cancel — deny consent
  - Audit logging for LOGIN_SUCCESS/FAILED, REGISTER_SUCCESS/FAILED
- Wire Handlebars view engine for OIDC interaction pages
- Initialize OIDC provider at server startup (dev + prod)
- Add MongoDB health check to /health endpoint
- Close OIDC + MongoDB on graceful shutdown
- Add database/index.ts and audit/index.ts for NodeNext module resolution
- Add #database/mongo and #audit path aliases to tsconfig
Co-authored-by: Cursor <cursoragent@cursor.com>

- Add MultiPoolService: registry of named Sequelize pools with create/get/close/healthcheck
- Add multi-pool config: write host + read replica host with separate ports
- Add DB_CONNECTION_STRING and DB_READ_HOST/DB_READ_PORT env vars
- Add docker-compose.ha.yml: Patroni + etcd cluster, HAProxy, PgBouncer
- Add HAProxy config: routes 5432 (write/primary) / 5433 (read/replica)
- Add PgBouncer userlist template
- Update dev/prod/staging configs with multi-pool hosts
Co-authored-by: Cursor <cursoragent@cursor.com>

- Add oidc-provider v9 for OIDC/OAuth2 authentication
- Add MongoDB client service for audit logging (sso_audit database)
- Add audit logger service with retry queue (up to 3 retries, 60s timeout)
- Add audit repository (insert, findByUserId, findByEventType)
- Add OIDC PostgreSQL adapter (grants storage)
- Add Handlebars views (login, register, consent)
- Add OIDC config service (issuer, TTL, cookie keys)
- Add oidc-grants and clients SQL migrations
- Update docker-compose: add PostgreSQL, MongoDB, rename containers
- Update .env.example: add OIDC, MongoDB, PostgreSQL variables
- Update package.json: add oidc-provider, mongodb, express-handlebars
- Update README with OIDC endpoints and architecture diagram
Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>