feat: rework OIDC to BFF (Backend-For-Frontend) cookie-session pattern

- backend: switch from OAuth2 Resource Server to OAuth2 Client (spring-boot-starter-oauth2-client)
- backend: configure Spring Security oauth2Login() with session cookie (JSESSIONID HttpOnly)
- backend: add UserController exposing /api/user to report authenticated user info
- backend: configure GET /logout with RP-initiated end-session support
- backend: update HelloController to use @AuthenticationPrincipal OAuth2User
- backend: update all tests to use .with(oidcLogin()) mock
- backend: explicitly configure OIDC provider endpoints to bypass discovery at test time
- frontend: remove angular-oauth2-oidc and @ngx-env/builder dependencies
- frontend: revert angular.json builders to standard @angular/build:*
- frontend: replace client-side OIDC flow with /api/user check + window.location redirects
- frontend: update app.config.ts and config.service.ts to remove OIDC configuration
- frontend: rewrite all unit tests to mock /api/user endpoint instead of OAuthService
- compose: move OIDC_CLIENT_ID and OIDC_CLIENT_SECRET to backend environment variables
- compose/dockerfile: remove frontend build-time OIDC ARG/ENV secrets

frontend/bun.lock

@@ -11,7 +11,6 @@
         "@angular/forms": "^22.0.0",
         "@angular/platform-browser": "^22.0.0",
         "@angular/router": "^22.0.0",
-        "angular-oauth2-oidc": "^22.0.2",
         "rxjs": "~7.8.0",
         "tslib": "^2.3.0",
       },
@@ -586,8 +585,6 @@
 
     "angular-eslint": ["angular-eslint@22.1.0", "", { "dependencies": { "@angular-devkit/core": ">= 22.0.0 < 23.0.0", "@angular-devkit/schematics": ">= 22.0.0 < 23.0.0", "@angular-eslint/builder": "22.1.0", "@angular-eslint/eslint-plugin": "22.1.0", "@angular-eslint/eslint-plugin-template": "22.1.0", "@angular-eslint/schematics": "22.1.0", "@angular-eslint/template-parser": "22.1.0", "@typescript-eslint/types": "^8.0.0", "@typescript-eslint/utils": "^8.0.0" }, "peerDependencies": { "@angular/cli": ">= 22.0.0 < 23.0.0", "eslint": "^9.0.0 || ^10.0.0", "typescript": "*", "typescript-eslint": "^8.0.0" } }, "sha512-LU5a6MOSeQTETnc4xaHi10p9S1cstNczr93sChi3rx8IzgH4+risIsjjQHVLSnQDrSGH2O8jAGCaChker7f7TQ=="],
 
-    "angular-oauth2-oidc": ["angular-oauth2-oidc@22.0.2", "", { "dependencies": { "tslib": "^2.5.2" }, "peerDependencies": { "@angular/common": ">=22.0.0", "@angular/core": ">=22.0.0" } }, "sha512-MDzmf0quLVnsCzVp/G7Pr6YTSMoMMo62u8QFqJzM3madQmWV5JI4dMppvuTPswH+4V2gx4zPXdCjnn8ikVZX+A=="],
-
     "ansi-escapes": ["ansi-escapes@7.3.0", "", { "dependencies": { "environment": "^1.0.0" } }, "sha512-BvU8nYgGQBxcmMuEeUEmNTvrMVjJNSH7RgW24vXexN4Ven6qCvy4TntnvlnwnMLTVlcRQQdbRY8NKnaIoeWDNg=="],
 
     "ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="],