Add verified OIDC self-service identity linking

[bifrost0x]

Summary

• let authenticated local users link a verified OIDC identity from Settings after an action-bound account step-up
• bind each link intent to one browser session, local user, authentication generation, and server-side authentication session
• atomically store only the validated (issuer, subject) pair while keeping username/email auto-linking disabled
• validate provider navigation URLs and split operator-facing rejection reasons without exposing account state to the browser
• generate account and administrator Step-up continuations on the server so root and APPLICATION_ROOT deployments use the correct return path
• align the Settings status indicator, German terminology, model wording, and all relevant OIDC documentation with the new flow

Security properties

• one-use state, nonce, PKCE, and exact account/session binding
• callback eligibility is revalidated after provider I/O; logout, lockout, authentication invalidation, and external account-management races fail closed
• (issuer, subject) remains database-unique, preventing identity reassignment
• tokens and raw subjects are neither logged nor returned by the self-service status endpoint
• LDAP-managed and GitHub-provisioned accounts remain excluded from self-linking
• browser-provided continuation paths are ignored for OIDC Step-up starts

Compatibility

• the schema migration only adds nullable columns to the short-lived OIDC state table; existing users and identity mappings are unchanged
• a migrated, in-flight legacy login state is consumed successfully by the new service, and existing login and administrator Step-up state shapes remain valid
• no new environment variable, callback URI, or provider registration is required
• root and APPLICATION_ROOT subfolder deployments return to server-generated Settings or Admin URLs
• existing OIDC login and manual administrator link/unlink flows remain available

Validation

Local validation on 484b8d4:

• Python suite: 2796 passed, 2 skipped
• focused OIDC, account Step-up, migration, security UI, and i18n suite: 96 passed
• Node test suite: 40 passed
• Playwright OIDC/Admin browser suite: 6 passed
• auth i18n generation check, ESLint, Python compilation, and git diff --check

All required GitHub Actions checks pass on 484b8d4, including CI pytest
(2796 passed, 2 skipped), Python 3.11, both browser shards, Redis 7/8, SSH and
SMB integration, CodeQL, container threading, and AMD64/ARM64 image security.

Fixes #208

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T05:20:13.238935Z	484b8d4	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1de7e83f0b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[bifrost0x]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: d0fc671480

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[bifrost0x]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: e0ce125af4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[bifrost0x]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 484b8d45e1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".