ep-auth — shared OIDC auth service

Diagnostic page for the OIDC flow this service runs against Meta's IdP at internalfb.com. It mints the shared __ep_session cookie that every app under the cookie domain reads.

… step 1Initiate OIDC authorize
GET /oauth/authorize redirects to the IdP authorize endpoint with response_type=code (PKCE + state). ?silent=1 attempts prompt=none for 0-click silent SSO.
Sign in via OIDCTry 0-click (prompt=none)
· step 2Callback: code exchange + userinfo
Server-side /auth/callback exchanges the code at the IdP token endpoint, then looks up userinfo. Errors redirect with ?err=…
· step 3Mint __ep_session cookie + verify identity
HS256 JWT signed with SESSION_SIGNING_SECRET. /api/me decodes the cookie and returns the verified identity available server-side.
Identity produced at app layer: (not yet signed in)
With the real internalfb.com IdP the sub claim is the FBID directly — no email→FBID bridging needed for downstream Nest BFF calls.