feat(auth): refactor authentication plugin

[FlandiaYingman]

#101

[wylited]

I like this, very cool.

[MisterCommand]

App is using TenantID c917... and is working fine, why are we changing it?

https://github.com/USThing/USThingApp/blob/1e0ee62278f37b1886c787d52d37a610919a8562/app/models/AuthenticationStore.ts#L29

[FlandiaYingman]

I am not really sure why the ust.hk tenant works fine, but theoretically we
should use the connect.ust.hk one for connect.ust.hk users and the ust.hk one
for ust.hk users. My guessing of why it works is that (1) both tenants share the
same JWKS (key set) (and in practice, most Azure OIDC uses the same key set);
and (2) the ust.hk tenant in app acts as the "issuer", and in practice a ust.hk
tenant can issue tokens on behalf of the connect.ust.hk tenant.

[FlandiaYingman]

The change in this PR is perfect.

---

I'm planning to adopt an alternative flow of authentication, which effectively creates our own tenant using the domain usthing.xyz. This way, we can create debugging accounts. But that's a future plan.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wylited]

legitimate

[FlandiaYingman]

aye aye, captain