Module auth 

Authentication module for Trustee API.

Uses PEP for OIDC/OAuth2:

• ResourceServerClient for JWT validation (offline, cached JWKS)
• OidcClient for authorization code + PKCE login flow
• PkceCookieManager for stateless PKCE state (HMAC-signed cookies)
• DevConfig for local development bypass

Two deployment modes:

• Standalone: browser hits /auth/login → IdP redirect → /auth/callback → cookie
• Centralized: external auth app sends Authorization: Bearer <token> directly

Token extraction order: Authorization: Bearer header → trustee_token cookie.

Structs

AuthConfig

Authentication configuration parsed from [oidc] and [dev] TOML sections.

AuthState

Shared authentication state, stored in ServerState.

AuthUser

Authenticated user info extracted from the token.

CallbackQuery

Query parameters for OIDC callback.

Enums

AuthError

Authentication errors.

Functions

auth_routes

Build the auth routes as a nested Router.

check_auth

Check authentication for a protected endpoint.