feat(auth): implement tokenlogin endpoint

[Junjiequan]

Description

This PR introduces a new authentication endpoint that allows users to log in using an ID Token issued by an external OpenID Connect (OIDC) provider.

New endpoint:

POST /auth/oidc/token

Accepts:
{ idToken: string }

The endpoint validates the provided ID Token with the external OIDC provider and, upon success, authenticates the user in SciCat and returns a SciCat JWT.

Refactors

New OpenID Client Module

A dedicated openid-client module has been created containing:

• OidcClientService
• OidcAuthService

The goal of this refactoring is to provide a single global OIDC client instance that can be reused across modules.
This is necessary because the same client is required by both the OIDC strategy and the token-based login flow.

Clear responsibilities

OIDC-related responsibilities have been separated to improve clarity and maintainability.

OidcClientService:

• Handles only OpenID Connect client discovery and instantiation

OidcAuthService:

• Contains application-level authentication logic
• Validates token sets
• Maps claims to user profiles
• Finds or creates users
• Returns authenticated user profile

OidcStrategy:

• Acts as a thin Passport adapter

New Feature - Rate Limiting

Rate limiting concept has been introduced using @nestjs/throttler. Currently it is applied only to the new endpoint POST /auth/oidc/token and the limit is set to 1 request per second per IP. If the limit is exceeded, the request will be rejected with HTTP 429 until the rate limit window resets. This prevents excessive token generation and protects the authentication endpoint from abuse.

NOTE: No global throttling is applied to other endpoints.

Motivation

This endpoint is useful in scenarios where authentication needs to be performed by providing only a valid ID Token issued by an external OIDC provider, without going through the standard redirect-based login flow.

Tests included

• Included for each change/fix?
• Passing?

Documentation

• swagger documentation updated (required for API changes)
• official documentation updated

official documentation info

[jl-wynen]

There is a typo in this file name: cilent instead of client.

[Junjiequan]

nice tach, it's fixed