feat(server): OIDC 登录支持（F23）

- 引入 openid-client，新增 /api/auth/oidc/login + /api/auth/oidc/callback
- 通过 email 绑定既有员工账号，保留密码登录 fallback
- OIDC 状态存 cookie(HMAC) + PKCE + SameSite=lax 防 CSRF
- 更新 env/README 与 v3 CSV 状态推进

deploy/trialrun/.env.example

@@ -15,6 +15,14 @@ JWT_SECRET="change_me_in_trialrun"
 # 生成方式示例：openssl rand -base64 32
 FIELD_ENCRYPTION_KEY=""
 
+# ===== OIDC/SSO（F23，可选）=====
+# OIDC_ENABLED="true"
+# OIDC_ISSUER_URL=""
+# OIDC_CLIENT_ID=""
+# OIDC_CLIENT_SECRET=""
+# OIDC_REDIRECT_URI="http://127.0.0.1:3000/api/auth/oidc/callback"
+# OIDC_SCOPES="openid profile email"
+
 # ===== 数据库（Compose 内部连接）=====
 POSTGRES_DB="hyb_oa"
 POSTGRES_USER="hyboa_user"

deploy/trialrun/docker-compose.yml

@@ -64,6 +64,12 @@ services:
       APP_ORIGIN: ${APP_ORIGIN}
       JWT_SECRET: ${JWT_SECRET}
       FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
+      OIDC_ENABLED: ${OIDC_ENABLED}
+      OIDC_ISSUER_URL: ${OIDC_ISSUER_URL}
+      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
+      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
+      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI}
+      OIDC_SCOPES: ${OIDC_SCOPES}
       DATABASE_URL: ${DATABASE_URL}
       STORAGE_DIR: ${STORAGE_DIR}
       STORAGE_DRIVER: ${STORAGE_DRIVER}
@@ -120,6 +126,12 @@ services:
       APP_ORIGIN: ${APP_ORIGIN}
       JWT_SECRET: ${JWT_SECRET}
       FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
+      OIDC_ENABLED: ${OIDC_ENABLED}
+      OIDC_ISSUER_URL: ${OIDC_ISSUER_URL}
+      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
+      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
+      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI}
+      OIDC_SCOPES: ${OIDC_SCOPES}
       DATABASE_URL: ${DATABASE_URL}
       STORAGE_DIR: ${STORAGE_DIR}
       STORAGE_DRIVER: ${STORAGE_DRIVER}
@@ -164,6 +176,12 @@ services:
       APP_ORIGIN: ${APP_ORIGIN}
       JWT_SECRET: ${JWT_SECRET}
       FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
+      OIDC_ENABLED: ${OIDC_ENABLED}
+      OIDC_ISSUER_URL: ${OIDC_ISSUER_URL}
+      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
+      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
+      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI}
+      OIDC_SCOPES: ${OIDC_SCOPES}
       DATABASE_URL: ${DATABASE_URL}
       STORAGE_DIR: ${STORAGE_DIR}
       STORAGE_DRIVER: ${STORAGE_DRIVER}