External identity provider (OIDC) connector

[recklessop]

What

torii authenticates all humans with local credentials today (bcrypt + TOTP, optional WebAuthn passkeys). The auth-backend seam for a second backend already exists in torii/auth_backends.py and the schema (auth_identities supports an oidc backend with provider + subject), but there is no OIDC connector wired up yet.

This issue tracks adding an OIDC / external identity provider login option (e.g. Authentik, Keycloak, Auth0, Google) so a non-admin human can sign in through an IdP and resolve to the same torii principal and the same grants.

Scope / constraints

• The admin GUI stays local-credential only by design. OIDC is for regular humans, chosen per-user, not a replacement for the local admin path.
• A federated login must resolve to a torii principal and go through the same torii.rbac resolver as everyone else. No second authorization path (see CONTRIBUTING.md).
• Group claims from the IdP should map to torii groups through the existing dormant groups.idp_claim column (NULL = local-only group; a claim only satisfies a group that declares it).
• A newly-federated principal starts with zero grants (default deny), same as any new local human.

Good first-issue notes

• torii/auth_backends.py is the seam; torii/credentials.py and torii/routes_oauth.py hold the local login flow to model against.
• Tests are the spec for anything security-shaped: a federated user with no grants must see an empty tool list, and an IdP group claim must not grant access unless a torii group maps it.

Discussion and design proposals welcome before code.