fix(oidc): harden session security from PR review (CSRF, revocation, refresh)

Address the high/medium correctness findings on the OIDC/SCIM PR:

- Login CSRF / session fixation: bind `state` to a Secure/HttpOnly/SameSite=Lax
  cookie at login and require the callback to echo it, so a code+state captured
  from another browser can't silently sign a victim into the attacker's account.
- Require `exp` on session JWTs under AUTH_TYPE=oidc (require_exp), so an
  exp-less HS256 token signed with JWT_SECRET_KEY can't authenticate forever or
  outlive the denylist.
- Denylist now keys revocation on an `iat` watermark instead of a deletable
  flag: a fresh login (newer iat) self-supersedes a revocation without clearing
  it, so sessions revoked on other devices stay revoked. Drops the
  login/SCIM-reactivation denylist-clearing paths (allow_user/allow_idp_sub).
- Refresh: gate the disabled-account check on the post-grant identity (not just
  the old sub); attempt the IdP grant before consuming the refresh token and
  return a retryable 503 (restoring the token) on transient IdP errors instead
  of force-logging-out a live session.
- Gate the oidc blueprint at request time on AUTH_TYPE=oidc, so non-oidc
  deployments cleanly 404 these routes instead of 500-ing on an unset
  OIDC_ISSUER (mirrors SCIM_ENABLED).
- Surface revocation write failures: back-channel logout returns 502, and SCIM
  deactivation rolls back and returns 503, when the denylist write fails — so
  the IdP retries instead of recording a logout/deprovision that didn't revoke.
- Back-channel logout: require `jti`, run the replay check unconditionally, and
  reject stale `iat` beyond the replay-cache window.
- Make migration 0017 idempotent (IF NOT EXISTS) so re-apply can't wedge startup.
- SCIM userName matching is case-insensitive (caseExact=false) for the list
  filter and create-dedup.

Tests added/updated across test_oidc.py, test_scim.py, test_auth.py,
test_app_routes.py and the SCIM integration test.

tests/integration/test_scim.py

@@ -58,10 +58,8 @@ def scim_env(monkeypatch):
     """Enable SCIM on the settings singleton and stub the Redis denylist."""
     monkeypatch.setattr(settings, "SCIM_ENABLED", True)
     monkeypatch.setattr(settings, "SCIM_TOKEN", SCIM_TOKEN)
-    with patch("application.api.scim.routes.deny_user") as deny_user_mock, patch(
-        "application.api.scim.routes.allow_user"
-    ) as allow_user_mock:
-        yield SimpleNamespace(deny_user=deny_user_mock, allow_user=allow_user_mock)
+    with patch("application.api.scim.routes.deny_user") as deny_user_mock:
+        yield SimpleNamespace(deny_user=deny_user_mock)
 
 
 @pytest.fixture
@@ -146,7 +144,8 @@ class TestScimLifecycle:
         assert response.status_code == 200
         assert response.get_json()["active"] is True
         assert _fetch_user(scim_user_name)["active"] is True
-        scim_env.allow_user.assert_called_once_with(scim_user_name)
+        # Reactivation no longer clears the denylist (watermark model).
+        scim_env.deny_user.assert_called_once_with(scim_user_name)
         assert any(e["event"] == "scim_reactivated" for e in _fetch_events(scim_user_name))
 
         # Soft delete deactivates again