feat(#86): implement Authentik OIDC integration for federation

Implements federated authentication infrastructure using OIDC:

- Add FederatedIdentity model to Prisma schema for identity mapping
- Create OIDCService with identity linking and token validation
- Add FederationAuthController with 5 endpoints:
  * POST /auth/initiate - Start federated auth flow
  * POST /auth/link - Link identity to remote instance
  * GET /auth/identities - List user's federated identities
  * DELETE /auth/identities/:id - Revoke identity
  * POST /auth/validate - Validate federated token
- Create comprehensive type definitions for OIDC flows
- Add audit logging for security events
- Write 24 passing tests (14 service + 10 controller)
- Achieve 79% coverage for OIDCService, 100% for controller

Notes:
- Token validation and auth URL generation are placeholder implementations
- Full JWT validation will be added when federation OIDC is actively used
- Identity mappings enforce workspace isolation
- All endpoints require authentication except /validate

Refs #86

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/api/prisma/schema.prisma

@@ -207,6 +207,7 @@ model User {
   userPreference         UserPreference?
   knowledgeEntryVersions KnowledgeEntryVersion[] @relation("EntryVersionAuthor")
   llmProviders           LlmProviderInstance[]   @relation("UserLlmProviders")
+  federatedIdentities    FederatedIdentity[]
 
   @@map("users")
 }
@@ -1280,3 +1281,23 @@ model FederationConnection {
   @@index([remoteInstanceId])
   @@map("federation_connections")
 }
+
+model FederatedIdentity {
+  id               String   @id @default(uuid()) @db.Uuid
+  localUserId      String   @map("local_user_id") @db.Uuid
+  remoteUserId     String   @map("remote_user_id")
+  remoteInstanceId String   @map("remote_instance_id")
+  oidcSubject      String   @map("oidc_subject")
+  email            String
+  metadata         Json     @default("{}")
+  createdAt        DateTime @default(now()) @map("created_at") @db.Timestamptz
+  updatedAt        DateTime @updatedAt @map("updated_at") @db.Timestamptz
+
+  user User @relation(fields: [localUserId], references: [id], onDelete: Cascade)
+
+  @@unique([localUserId, remoteInstanceId])
+  @@index([localUserId])
+  @@index([remoteInstanceId])
+  @@index([oidcSubject])
+  @@map("federated_identities")
+}