Summary

• add frontend-neutral OIDC identity, tenant membership, explicit enrollment, invitation, cloud-dev bootstrap, revocable web-session, CSRF, and upload-intent domain contracts
• add WEB-02/03 ports that keep provider tokens outside the core and require serializable challenge/invitation/session transitions
• add same-origin Web API DTOs with stable error envelopes, bounded pagination/attachments, secure cookie defaults, and no tenant authority in normal mutation bodies
• add contract tests for forged/replayed OIDC state and claims, invitation expiry/subject/replay/concurrency, two-user/two-tenant authorization, session rotation/revocation/security-version changes, CSRF, and upload isolation
• publish the English protocol/defaults, operator bootstrap procedure, API authorization matrix, and focused threat model

Architecture boundary

Telegram is used only as the first OIDC identity provider in this slice. Telegram chat history and webhook reachability are not dependencies. Authentication may create or refresh an external identity mapping, but tenant access requires an existing authorized frontend grant, a one-time invitation, or an audited cloud-dev bootstrap. The WebUI remains a projection over canonical Sessionless sessions/events.

This PR defines contracts only. YDB auth persistence and the Go BFF remain WEB-02 (#31).

Verification

• make ci
• git diff --check

Closes #30