feat: integrate Logto OIDC for user authentication

- Add Logto OIDC integration (app/core/logto.py): CookieStorage adapter,
  create/decode session token helpers, sync_logto_user upsert
- New auth endpoints (/api/v1/auth): sign-in, callback, sign-out, me
- AuthRedirectMiddleware: protects HTML pages, redirects to /setup when
  Logto is unconfigured, to /login otherwise
- Update require_admin_auth: accepts dmarq_session cookie JWT first,
  then API key, then Bearer JWT (fully backward compatible)
- Update User model: add logto_id, username, picture, created_at, updated_at;
  make hashed_password nullable for Logto-only users; is_superuser default=True
- New Alembic migration d4e5f6a7b8c9 for the above schema changes
- Add LOGTO_ENDPOINT / LOGTO_APP_ID / LOGTO_APP_SECRET / LOGTO_REDIRECT_URI
  settings with logto_configured property
- Create login.html (Sign in with Logto button) and setup.html (step-by-step
  configuration guide)
- Update base.html: user menu with avatar/name and sign-out via Alpine.js
  fetch to /api/v1/auth/me
- Update settings.html: remove localStorage adminApiKey; session cookie is
  sent automatically by browser; add 401 → /login redirect
- Update requirements.txt: replace fastapi-users additions with logto + aiohttp
- Add test_auth.py: 18 new tests covering session tokens, CookieStorage,
  sync_logto_user, /me, /sign-in (503), /sign-out cookie clearing
- Fix test_security_extra.py: pass Request mock to require_admin_auth;
  add new test_valid_session_cookie_returns_auth_context

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/b448f585-7646-40f8-ae2d-9986c361e3fd

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

backend/app/main.py

@@ -17,10 +17,11 @@ from app.api.api_v1.api import api_router
 from app.core.config import get_settings
 from app.core.database import Base, SessionLocal, engine
 from app.core.security import add_api_key, generate_api_key, require_admin_auth
+from app.middleware.auth import AuthRedirectMiddleware
 from app.middleware.security import SecurityHeadersMiddleware
 from app.models.mail_source import MailSource  # noqa: F401 – ensure table is registered
-from app.services.gmail_client import GmailClient
 from app.models.user import User  # noqa: F401 – ensure User mapper is registered
+from app.services.gmail_client import GmailClient
 from app.services.imap_client import IMAPClient
 from app.services.report_store import ReportStore
 
@@ -255,6 +256,9 @@ def create_app() -> FastAPI:
     environment = os.getenv("ENVIRONMENT", "development")
     application.add_middleware(SecurityHeadersMiddleware, environment=environment)
 
+    # Auth redirect middleware – protects HTML pages; must sit outside CORS
+    application.add_middleware(AuthRedirectMiddleware)
+
     # Improved CORS configuration - restrict to specific methods and headers
     if settings.BACKEND_CORS_ORIGINS:
         application.add_middleware(
@@ -362,13 +366,28 @@ async def dashboard(request: Request):
 
 
 @app.get("/login", response_class=HTMLResponse)
-async def login(request: Request):
-    return templates.TemplateResponse(request, "login.html", {"app_name": settings.PROJECT_NAME})
+async def login(request: Request, next: str = "/"):
+    return templates.TemplateResponse(
+        request,
+        "login.html",
+        {
+            "app_name": settings.PROJECT_NAME,
+            "logto_configured": settings.logto_configured,
+            "next": next,
+        },
+    )
 
 
 @app.get("/setup", response_class=HTMLResponse)
 async def setup(request: Request):
-    return templates.TemplateResponse(request, "setup.html", {"app_name": settings.PROJECT_NAME})
+    return templates.TemplateResponse(
+        request,
+        "setup.html",
+        {
+            "app_name": settings.PROJECT_NAME,
+            "logto_configured": settings.logto_configured,
+        },
+    )
 
 
 @app.get("/domains", response_class=HTMLResponse)
@@ -418,9 +437,7 @@ async def reports(request: Request):
 @app.get("/reports/{report_id}", response_class=HTMLResponse)
 async def report_detail(request: Request, report_id: str):
     """View detailed information for a specific DMARC report"""
-    return templates.TemplateResponse(
-        request, "report_detail.html", {"report_id": report_id}
-    )
+    return templates.TemplateResponse(request, "report_detail.html", {"report_id": report_id})
 
 
 @app.get("/settings", response_class=HTMLResponse)