feat(#86): implement Authentik OIDC integration for federation

Implements federated authentication infrastructure using OIDC:

- Add FederatedIdentity model to Prisma schema for identity mapping
- Create OIDCService with identity linking and token validation
- Add FederationAuthController with 5 endpoints:
  * POST /auth/initiate - Start federated auth flow
  * POST /auth/link - Link identity to remote instance
  * GET /auth/identities - List user's federated identities
  * DELETE /auth/identities/:id - Revoke identity
  * POST /auth/validate - Validate federated token
- Create comprehensive type definitions for OIDC flows
- Add audit logging for security events
- Write 24 passing tests (14 service + 10 controller)
- Achieve 79% coverage for OIDCService, 100% for controller

Notes:
- Token validation and auth URL generation are placeholder implementations
- Full JWT validation will be added when federation OIDC is actively used
- Identity mappings enforce workspace isolation
- All endpoints require authentication except /validate

Refs #86

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/api/src/federation/dto/federated-auth.dto.ts

@@ -0,0 +1,51 @@
+/**
+ * Federated Authentication DTOs
+ *
+ * Data transfer objects for federated OIDC authentication endpoints.
+ */
+
+import { IsString, IsEmail, IsOptional, IsObject } from "class-validator";
+
+/**
+ * DTO for initiating federated authentication
+ */
+export class InitiateFederatedAuthDto {
+  @IsString()
+  remoteInstanceId!: string;
+
+  @IsOptional()
+  @IsString()
+  redirectUrl?: string;
+}
+
+/**
+ * DTO for linking federated identity
+ */
+export class LinkFederatedIdentityDto {
+  @IsString()
+  remoteInstanceId!: string;
+
+  @IsString()
+  remoteUserId!: string;
+
+  @IsString()
+  oidcSubject!: string;
+
+  @IsEmail()
+  email!: string;
+
+  @IsOptional()
+  @IsObject()
+  metadata?: Record<string, unknown>;
+}
+
+/**
+ * DTO for validating federated token
+ */
+export class ValidateFederatedTokenDto {
+  @IsString()
+  token!: string;
+
+  @IsString()
+  instanceId!: string;
+}