feat: rework OIDC to BFF (Backend-For-Frontend) cookie-session pattern

- backend: switch from OAuth2 Resource Server to OAuth2 Client (spring-boot-starter-oauth2-client)
- backend: configure Spring Security oauth2Login() with session cookie (JSESSIONID HttpOnly)
- backend: add UserController exposing /api/user to report authenticated user info
- backend: configure GET /logout with RP-initiated end-session support
- backend: update HelloController to use @AuthenticationPrincipal OAuth2User
- backend: update all tests to use .with(oidcLogin()) mock
- backend: explicitly configure OIDC provider endpoints to bypass discovery at test time
- frontend: remove angular-oauth2-oidc and @ngx-env/builder dependencies
- frontend: revert angular.json builders to standard @angular/build:*
- frontend: replace client-side OIDC flow with /api/user check + window.location redirects
- frontend: update app.config.ts and config.service.ts to remove OIDC configuration
- frontend: rewrite all unit tests to mock /api/user endpoint instead of OAuthService
- compose: move OIDC_CLIENT_ID and OIDC_CLIENT_SECRET to backend environment variables
- compose/dockerfile: remove frontend build-time OIDC ARG/ENV secrets

frontend/src/app/app.ts

@@ -1,6 +1,5 @@
 import { Component, signal, inject, OnInit, effect } from '@angular/core';
-import { OAuthService } from 'angular-oauth2-oidc';
-import { HttpClient, HttpHeaders } from '@angular/common/http';
+import { HttpClient } from '@angular/common/http';
 import { ApartmentService, Apartment } from './apartment.service';
 import { FormsModule } from '@angular/forms';
 
@@ -27,7 +26,10 @@ export class App implements OnInit {
   formDescription = '';
   formError = '';
 
-  private readonly oauthService = inject(OAuthService);
+  private readonly _isLoggedIn = signal<boolean>(false);
+  private readonly _username = signal<string>('');
+  private readonly _email = signal<string>('');
+
   private readonly http = inject(HttpClient);
   private readonly apartmentService = inject(ApartmentService);
 
@@ -40,40 +42,49 @@ export class App implements OnInit {
   }
 
   ngOnInit() {
-    if (this.isLoggedIn) {
-      this.loadApartments();
-    }
+    this.http.get<{authenticated: boolean, username?: string, email?: string}>('/api/user').subscribe({
+      next: (user) => {
+        if (user.authenticated) {
+          this._isLoggedIn.set(true);
+          this._username.set(user.username || 'User');
+          this._email.set(user.email || '');
+        } else {
+          this._isLoggedIn.set(false);
+          this._username.set('');
+          this._email.set('');
+        }
+      },
+      error: (err) => {
+        console.error('Error fetching user authentication status', err);
+        this._isLoggedIn.set(false);
+        this._username.set('');
+        this._email.set('');
+      }
+    });
   }
 
   get isLoggedIn(): boolean {
-    return this.oauthService.hasValidAccessToken();
+    return this._isLoggedIn();
   }
 
   get username(): string {
-    const claims = this.oauthService.getIdentityClaims() as Record<string, string> | null;
-    if (!claims) return '';
-    return claims['preferred_username'] || claims['given_name'] || claims['name'] || 'User';
+    return this._username();
   }
 
   get email(): string {
-    const claims = this.oauthService.getIdentityClaims() as Record<string, string> | null;
-    return claims ? claims['email'] : '';
+    return this._email();
   }
 
   login() {
-    this.oauthService.initCodeFlow();
+    window.location.href = '/oauth2/authorization/oidc';
   }
 
   logout() {
-    this.oauthService.revokeTokenAndLogout();
+    window.location.href = '/logout';
   }
 
   callHelloApi() {
-    const headers = new HttpHeaders({
-      'Authorization': 'Bearer ' + this.oauthService.getAccessToken()
-    });
-
-    this.http.get('/api/hello', { headers, responseType: 'text' }).subscribe({
+    this.http.get('/api/hello', { responseType: 'text' }).subscribe({
       next: (msg) => this.helloMessage.set(msg),
       error: (err) => {
         console.error(err);