Add generic OIDC auth provider with native Microsoft Entra support - #192

…ntial guards & admin UI (#219)

* docs: design for external (SSO) users in the users module

Marks IdP-provisioned users external with a genuinely null password,
guards all password-credential paths, surfaces the marking in the admin
UI, and keeps normal role assignment. Independent of PR #192.

Claude-Session: https://claude.ai/code/session_012kKthZeQPYEUWRL4jygquY

* feat(users): provision external (SSO) users with null password

Users created via OAuth/OIDC login (Microsoft/Entra, Google, GitHub,
generic OIDC) are now first-class rows in users_user, marked external
with a truly NULL password instead of a random one — so they sign in
only through their IdP and admins manage their roles like any other
user.

Backend
- models/user.py: hashed_password is now nullable; add is_external
  (server_default false). Migration 92965b00f105 makes the column
  nullable + adds the marker via batch_alter_table (SQLite rebuild
  recreates the lower(email) functional index). Forks off the users
  head (873ca2015033), not the keycloak branch, keeping the users
  migration line independent of the optional keycloak provider.
- oauth/api.py: flag the request before find-or-create so the manager
  can mark only *newly provisioned* OAuth users. Logins that link to an
  existing password account are untouched (on_after_register won't
  fire) — link-by-email behaviour is preserved.
- manager.py: on_after_register nulls the password + sets is_external
  for OAuth-provisioned users; authenticate() and forgot_password()
  refuse external users (no local password); generate_reset_password_token
  raises ExternalUserNoPasswordError instead of hashing None.
- admin reset-password-link returns 409 for external users.
- expose is_external in UserRead / UserListItem + admin list query.

Frontend
- list + detail surface an "External · SSO" / SSO badge; the detail
  page hides the password-reset action for external users and explains
  why.

Tests
- test_external_users.py: provisioning (new vs linked), credential
  guards (login, reset-link, forgot-password no-op), role assignment,
  and admin-list visibility. Full users suite: 303 passed.

No default role is assigned; scope covers any OAuth/OIDC-provisioned
user. The standalone oidc module (PR #192) remains separate for the
bearer/stateless use case.

Claude-Session: https://claude.ai/code/session_012kKthZeQPYEUWRL4jygquY

* fix(users): block bearer-token login for external (SSO) users

Code-review (round 1) finding: the bearer-token login path
(POST /api/users/auth/token) verified the password directly instead of
going through the guarded UserManager.authenticate, so an external user
(hashed_password is None) hit verify_and_update(pw, None) -> TypeError ->
500, which also leaked account type via timing/error (missing user got a
clean 401 after a dummy hash). Treat null-password users like a missing
user: run the dummy hash and return 401.

Also align forgot_password's no-op guard to (is_external or
hashed_password is None) to match generate_reset_password_token, add a
regression test for the bearer path, and note the downgrade constraint.

Claude-Session: https://claude.ai/code/session_012kKthZeQPYEUWRL4jygquY

* fix: resolve ty 0.0.52 diagnostics (repo-wide lint unblock)

ty 0.0.52 newly flags previously-valid suppressions. Remove four now-unused
'# ty: ignore[invalid-assignment]' directives (framework/core/tests/*,
users/backend.py) and add '# ty: ignore[unsupported-base]' to keycloak's
SQLModel table class, matching the users User model. Comment-only; no behavior
change. Unblocks 'make lint' / CI typecheck, which fails repo-wide otherwise.

Claude-Session: https://claude.ai/code/session_012kKthZeQPYEUWRL4jygquY