Integrate native eSignet 2.0 BREG login and verified Portal OIDC

[jeremi]

Replace the Java eSignet startup and JAR injection with the native eSignet 2.0 BREG candidate and matching UI. The Portal now uses openid-client to validate the OIDC journey, including ID-token signatures and UserInfo subject correlation.

Changes

• Add a reproducible local BREG/Mint/eSignet fixture with synthetic data, OTP-only authentication, and fresh consent; update local and hosted Compose, proxy routes, discovery, health checks, client seeding, and secret provisioning.
• Use separate eSignet 2.0 database, Redis, and key-storage volumes, preserving existing volumes. Keep administrative bootstrap endpoints private and signing keys independent.
• Preserve private-key JWT client authentication and PKCE while validating state, nonce, issuer, audience, signature, and subject correlation. Exercise signed UserInfo by default and encrypted UserInfo with a separate test client.
• Refresh compatible UI dependencies, verify the patched lockfile before installation, and retain the pinned beta UI and Thunder SDK versions.
• Close SQLite and HTTP resources so the full Lab test gate passes without warning suppression.
• Document local build, startup, login, consent, and troubleshooting.

Validation

• Full just test passed without PYTHONWARNINGS suppression or ResourceWarnings, including 163 Portal tests. Portal type checks and build passed.
• Real eSignet/Mint/BREG protocol proof: 8 checks passed. Browser integration: 7 hosted-mode tests passed, 2 mock-only skips; mock-mode coverage also passed.
• UI: 226 tests and build passed; full and production npm audits report zero advisories. Baseline UI lint findings are unchanged: 23 errors and 6 warnings.
• Local and hosted Compose validation passed. Both amd64 and arm64 UI candidate artifacts were built with verified checksums, source metadata, and lockfile labels.
• Broad just smoke could not pass with the isolated BREG fixture because Home and five other Lab services were not running. just review is documented but has no recipe in the repository.

Delivery boundary

Candidate images remain local. This PR does not publish artifacts or change the hosted deployment. Relay integration and production OTP remain outside this phase.

Provider implementation: registrystack/esignet-relay-authenticator#6

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T14:36:32.937331Z	90aed70	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 90aed702be

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Provision hosted eSignet inputs instead of local fixture files

In a clean Coolify checkout this source directory does not exist: a repo-wide search shows it is ignored and populated only by the local breg/dev.py start workflow, whose generated configuration uses host.docker.internal BREG and Mint endpoints that the hosted compose does not provide. Consequently esignet-key-init fails at cp /source/* /config/, blocking the dependent eSignet service; even manually copying the local output would target absent services. Add a hosted secret/config provisioning path with reachable hosted BREG and Mint endpoints rather than binding local fixture output.

AGENTS.md reference: AGENTS.md:L11-L13

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Avoid a globally exhaustible pending-login cap

Because /auth/login is unauthenticated, a client that discards the returned cookie can issue 1,000 requests and leave 1,000 distinct entries in this process-wide map. Every legitimate login then receives a 503 until entries expire ten minutes later, and an attacker can sustain the outage with only a few requests per second. The bound needs eviction or a limit tied to an authenticated/per-client resource rather than rejecting all users when this global threshold is reached.

Useful? React with 👍 / 👎.