fix(oidc): harden session security from PR review (CSRF, revocation, refresh)

Address the high/medium correctness findings on the OIDC/SCIM PR:

- Login CSRF / session fixation: bind `state` to a Secure/HttpOnly/SameSite=Lax
  cookie at login and require the callback to echo it, so a code+state captured
  from another browser can't silently sign a victim into the attacker's account.
- Require `exp` on session JWTs under AUTH_TYPE=oidc (require_exp), so an
  exp-less HS256 token signed with JWT_SECRET_KEY can't authenticate forever or
  outlive the denylist.
- Denylist now keys revocation on an `iat` watermark instead of a deletable
  flag: a fresh login (newer iat) self-supersedes a revocation without clearing
  it, so sessions revoked on other devices stay revoked. Drops the
  login/SCIM-reactivation denylist-clearing paths (allow_user/allow_idp_sub).
- Refresh: gate the disabled-account check on the post-grant identity (not just
  the old sub); attempt the IdP grant before consuming the refresh token and
  return a retryable 503 (restoring the token) on transient IdP errors instead
  of force-logging-out a live session.
- Gate the oidc blueprint at request time on AUTH_TYPE=oidc, so non-oidc
  deployments cleanly 404 these routes instead of 500-ing on an unset
  OIDC_ISSUER (mirrors SCIM_ENABLED).
- Surface revocation write failures: back-channel logout returns 502, and SCIM
  deactivation rolls back and returns 503, when the denylist write fails — so
  the IdP retries instead of recording a logout/deprovision that didn't revoke.
- Back-channel logout: require `jti`, run the replay check unconditionally, and
  reject stale `iat` beyond the replay-cache window.
- Make migration 0017 idempotent (IF NOT EXISTS) so re-apply can't wedge startup.
- SCIM userName matching is case-insensitive (caseExact=false) for the list
  filter and create-dedup.

Tests added/updated across test_oidc.py, test_scim.py, test_auth.py,
test_app_routes.py and the SCIM integration test.

tests/test_auth.py

@@ -46,7 +46,7 @@ class TestHandleAuth:
             "valid_token",
             "secret",
             algorithms=["HS256"],
-            options={"verify_exp": False},
+            options={"verify_exp": False, "require_exp": False},
         )
 
     def test_returns_error_on_invalid_jwt(self):
@@ -117,7 +117,7 @@ class TestHandleAuthOidc:
             "valid_token",
             "secret",
             algorithms=["HS256"],
-            options={"verify_exp": True},
+            options={"verify_exp": True, "require_exp": True},
         )
 
     def test_expired_token_returns_token_expired(self):
@@ -154,10 +154,10 @@ class TestHandleAuthOidc:
 
         assert result["error"] == "invalid_token"
 
-    def test_token_without_exp_passes_real_jose(self):
-        # Pins that e2e/integration helper tokens (signed without an exp
-        # claim) stay valid under oidc: python-jose only validates claims
-        # that are present.
+    def test_token_without_exp_rejected_under_oidc(self):
+        # Under oidc, exp is REQUIRED: an exp-less HS256 token signed with the
+        # shared secret (e.g. a legacy simple_jwt/session_jwt token) must not
+        # authenticate, or it would be valid forever and unrevocable.
         from jose import jwt as real_jwt
 
         from application.auth import handle_auth
@@ -171,7 +171,7 @@ class TestHandleAuthOidc:
             mock_settings.JWT_SECRET_KEY = "secret"
             result = handle_auth(mock_request)
 
-        assert result == {"sub": "helper_user"}
+        assert result["error"] == "invalid_token"
 
     def test_expired_token_real_jose(self):
         import time