feat(ogar-oidc): provider-agnostic OIDC ID-token verifier (PR-01)

Cargo.toml

@@ -26,6 +26,7 @@ members = [
     "crates/ogar-adapter-python",
     "crates/ogar-adapter-csharp",
     "crates/ogar-auth",
+    "crates/ogar-oidc",
     "crates/ogar-encryption",
     "crates/ogar-doc-ir",
     "crates/ogar-a2ui-frame",
@@ -129,3 +130,8 @@ surrealdb-core   = { git = "https://github.com/AdaWorldAPI/surrealdb", branch =
 # temporary edit, not a reason to keep the default expensive.
 [profile.dev]
 debug = 0
+
+# ecdsa (pulled by p256 for ogar-oidc's ES256) resolves to the AdaWorldAPI fork
+# of RustCrypto/signatures, at the same 0.17.0 version crates.io carries.
+[patch.crates-io]
+ecdsa = { git = "https://github.com/AdaWorldAPI/signatures", rev = "5595c3b1bfa14022b46ec3cc662a87e49b954266" }

crates/ogar-oidc/Cargo.toml

@@ -0,0 +1,18 @@
+[package]
+name = "ogar-oidc"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+description = "Provider-agnostic OIDC ID-token verifier for ogar-auth: implements `AssertionVerifier` over compact JWS ID tokens (ES256, EdDSA) against per-issuer JWKS the caller supplies. No network I/O, no provider-specific claims."
+
+[dependencies]
+ogar-auth = { path = "../ogar-auth" }
+# Ed25519 verification — reused from OGAR's encryption surface, never re-implemented.
+ogar-encryption = { path = "../ogar-encryption" }
+# ES256 (P-256 ECDSA). AdaWorldAPI fork of RustCrypto/elliptic-curves, the rev the
+# ndarray `encryption` crate already pins for x448. `ecdsa` itself is redirected to
+# the AdaWorldAPI/signatures fork by the workspace `[patch.crates-io]`.
+p256 = { git = "https://github.com/AdaWorldAPI/elliptic-curves", rev = "739304e026fdf06cd1a31606e4db487d3f47c5ae", default-features = false, features = ["ecdsa", "alloc"] }
+base64 = "0.22"
+serde_json = "1"