Comprehensive scan of backend (40 migrations, 64 models, OIDC provider,
multi-pool service, audit service) + 2 demo apps (project-a, project-b)
+ cross-project SSO analysis revealed 8 critical gaps and 7 pre-existing
TS errors that block end-to-end testing.

Key findings:
- validateCredentials is still a TODO stub (login does not work yet)
- oidcAdapterService is missing findSession/upsertSession (session not persisted)
- No prompt=none handling (silent SSO impossible)
- Cookie domain .meucorp.com does not match localhost pattern
- findAccount returns only static { sub } (userinfo has no claims)
- 7 pre-existing TS errors in verify-email, resend-verification, server.ts
- 18 untracked files from stale sso-vietprodev-old stash (cleanup needed)
- .env points to port 5433 (legacy from HA cluster) but Docker only maps 5432

User-confirmed decisions (locked in PLANS.md section 4):
1. Two PostgreSQL instances from Phase 0 (main:5432, backup:5433)
2. Cross-project silent SSO via prompt=none (OIDC standard) - rejects
   subdomain pattern as it would require refactor on production deploy
3. Drop old vietprodev_sso database after SQL backup safety net
4. Docker credentials simplified to sso/sso (instead of postgres/@dmin123)
5. PostgreSQL 17-alpine for both containers (stable, well-documented)
6. Clean up 18 untracked files after diff-verify against stash backup

PLANS.md contains:
- 5 phases (0-4) totaling 24-33h
- Architecture diagram (main + backup + mongo + redis + minio)
- 4 ADRs (OIDC adapter, audit destination, SSO mechanism, port layout)
- File touch list per phase
- Risk register with mitigations
- Status tracking table

Refs: silent SSO, prompt=none, OIDC, cross-project session,
pre-existing TS errors, PostgreSQL HA, MongoDB audit
Co-authored-by: Cursor <cursoragent@cursor.com>