feat(#86): implement Authentik OIDC integration for federation

Implements federated authentication infrastructure using OIDC:

- Add FederatedIdentity model to Prisma schema for identity mapping
- Create OIDCService with identity linking and token validation
- Add FederationAuthController with 5 endpoints:
  * POST /auth/initiate - Start federated auth flow
  * POST /auth/link - Link identity to remote instance
  * GET /auth/identities - List user's federated identities
  * DELETE /auth/identities/:id - Revoke identity
  * POST /auth/validate - Validate federated token
- Create comprehensive type definitions for OIDC flows
- Add audit logging for security events
- Write 24 passing tests (14 service + 10 controller)
- Achieve 79% coverage for OIDCService, 100% for controller

Notes:
- Token validation and auth URL generation are placeholder implementations
- Full JWT validation will be added when federation OIDC is actively used
- Identity mappings enforce workspace isolation
- All endpoints require authentication except /validate

Refs #86

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/api/src/federation/audit.service.ts

@@ -24,4 +24,42 @@ export class FederationAuditService {
       securityEvent: true,
     });
   }
+
+  /**
+   * Log federated authentication initiation
+   */
+  logFederatedAuthInitiation(userId: string, remoteInstanceId: string): void {
+    this.logger.log({
+      event: "FEDERATION_AUTH_INITIATED",
+      userId,
+      remoteInstanceId,
+      timestamp: new Date().toISOString(),
+    });
+  }
+
+  /**
+   * Log federated identity linking
+   */
+  logFederatedIdentityLinked(userId: string, remoteInstanceId: string): void {
+    this.logger.log({
+      event: "FEDERATION_IDENTITY_LINKED",
+      userId,
+      remoteInstanceId,
+      timestamp: new Date().toISOString(),
+      securityEvent: true,
+    });
+  }
+
+  /**
+   * Log federated identity revocation
+   */
+  logFederatedIdentityRevoked(userId: string, remoteInstanceId: string): void {
+    this.logger.warn({
+      event: "FEDERATION_IDENTITY_REVOKED",
+      userId,
+      remoteInstanceId,
+      timestamp: new Date().toISOString(),
+      securityEvent: true,
+    });
+  }
 }