Overview
OIDC and SAML identity providers + session lifecycle. Layers browser-based auth on top of the static bearer-token surface: bearer tokens continue to work byte-shape-identical; session tokens use the kgi_sk_* prefix so the same middleware routes both flavors. Providers are caller-plugged via IdentityProviderBinding (no baked-in list); sign-in runs in the deployment, which reads them. Sessions persist via SessionStoreBinding. clientSecretRef is a REFERENCE — the plaintext secret never crosses the wire.