feat(dashboard): complete CV branching dashboard with auth and full editing workflow

- Visual branch heritage tree with colored dots and connecting lines, depth-aware expand/collapse
- Dashboard 3-tab layout: Content (inline block editing + patch staging), Patches (diff view), Submissions (AI suggestions)
- Inline block editing: click to edit any CV block, stage edits, save as named branch with pre-filled patches
- Submissions tab: create applications, request AI tailoring suggestions, accept/reject per suggestion
- Simple hardcoded login (username/password via env vars LOGIN_USER/LOGIN_PASS, defaults admin/admin)
- Authentik OIDC integration: authorize redirect + callback exchange, configurable via NEXT_PUBLIC_AUTHENTIK_*
- Middleware protecting /dashboard with session cookie verification (HMAC-SHA256)
- Auth API routes: /api/auth/login, /api/auth/logout, /api/auth/callback, /api/auth/token
- Backend: GET/PATCH submission routes for listing submissions and accepting/rejecting AI suggestions
- API client: OIDC bearer token forwarding from client-readable cookie

https://claude.ai/code/session_01CdisLhbC2kVt2hxfJ7TNPf

apps/webapp/src/app/api/auth/callback/route.ts

@@ -0,0 +1,43 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+export async function GET(req: NextRequest) {
+    const { searchParams, origin } = new URL(req.url);
+    const code = searchParams.get('code');
+
+    if (!code) return NextResponse.redirect(`${origin}/login?error=no_code`);
+
+    const issuer = process.env.AUTHENTIK_ISSUER;
+    const clientId = process.env.AUTHENTIK_CLIENT_ID;
+    const clientSecret = process.env.AUTHENTIK_CLIENT_SECRET;
+    const redirectUri = `${process.env.NEXT_PUBLIC_BASE_URL ?? origin}/api/auth/callback`;
+
+    if (!issuer || !clientId || !clientSecret) {
+        return NextResponse.redirect(`${origin}/login?error=oidc_not_configured`);
+    }
+
+    const tokenRes = await fetch(`${issuer}/application/o/token/`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'authorization_code', code,
+            redirect_uri: redirectUri, client_id: clientId, client_secret: clientSecret,
+        }),
+    }).catch(() => null);
+
+    if (!tokenRes?.ok) return NextResponse.redirect(`${origin}/login?error=token_exchange`);
+
+    const tokens = await tokenRes.json();
+    const res = NextResponse.redirect(`${origin}/dashboard`);
+    res.cookies.set('oidc_token', tokens.access_token, {
+        httpOnly: true, sameSite: 'lax', path: '/',
+        maxAge: tokens.expires_in ?? 3600,
+        secure: process.env.NODE_ENV === 'production',
+    });
+    // non-httpOnly copy for client-side API bearer usage
+    res.cookies.set('oidc_token_pub', tokens.access_token, {
+        httpOnly: false, sameSite: 'lax', path: '/',
+        maxAge: tokens.expires_in ?? 3600,
+        secure: process.env.NODE_ENV === 'production',
+    });
+    return res;
+}

apps/webapp/src/app/api/auth/login/route.ts

@@ -0,0 +1,27 @@
+import { NextRequest, NextResponse } from 'next/server';
+import crypto from 'node:crypto';
+
+const SECRET = process.env.SESSION_SECRET ?? 'dev-secret-change-in-production';
+const LOGIN_USER = process.env.LOGIN_USER ?? 'admin';
+const LOGIN_PASS = process.env.LOGIN_PASS ?? 'admin';
+
+function sign(value: string) {
+    return crypto.createHmac('sha256', SECRET).update(value).digest('hex');
+}
+
+export async function POST(req: NextRequest) {
+    const body = await req.json().catch(() => ({}));
+    const { username, password } = body as Record<string, string>;
+    if (!username || !password || username !== LOGIN_USER || password !== LOGIN_PASS) {
+        return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 });
+    }
+    const payload = `${username}:${Date.now()}`;
+    const token = `${payload}.${sign(payload)}`;
+    const res = NextResponse.json({ ok: true });
+    res.cookies.set('session', token, {
+        httpOnly: true, sameSite: 'lax', path: '/',
+        maxAge: 60 * 60 * 24 * 7,
+        secure: process.env.NODE_ENV === 'production',
+    });
+    return res;
+}

apps/webapp/src/app/api/auth/logout/route.ts

@@ -0,0 +1,8 @@
+import { NextResponse } from 'next/server';
+
+export async function POST() {
+    const res = NextResponse.json({ ok: true });
+    res.cookies.delete('session');
+    res.cookies.delete('oidc_token');
+    return res;
+}

apps/webapp/src/app/api/auth/token/route.ts

@@ -0,0 +1,6 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+export async function GET(req: NextRequest) {
+    const token = req.cookies.get('oidc_token')?.value ?? null;
+    return NextResponse.json({ token });
+}