Add Hanko SSO authentication support

[hg1g]

Summary

• Add Hanko SSO authentication as an alternative to legacy OSM OAuth
• Integrate hotosm_auth_django package for authentication middleware
• Add onboarding flow for new users and legacy user migration
• Update frontend with @hotosm/hanko-auth web component

Environment Variables

When deploying with Hanko auth, set these env vars:

AUTH_PROVIDER=hanko
HANKO_API_URL=https://login.hotosm.org  # or dev.login.hotosm.org for dev
COOKIE_SECRET=<32-byte-secret>
COOKIE_DOMAIN=.hotosm.org
COOKIE_SECURE=true
LOGIN_URL=https://login.hotosm.org
OSM_REDIRECT_URI=https://login.hotosm.org/api/auth/osm/callback
ADMIN_EMAILS=<comma-separated-emails>

For secret values (COOKIE_SECRET, etc.), contact me on Slack.

After Merge

Run migrations to create the hanko_user_mappings table:

uv run python manage.py migrate

Running Tests

To run the Hanko auth and onboarding tests:

cd backend
uv run python manage.py test tests.test_hanko_auth tests.test_onboarding -v 2

Or run all tests:

cd backend
uv run coverage run manage.py test tests

Test plan

• Run test_hanko_auth.py tests
• Run test_onboarding.py tests
• Test login flow with Hanko SSO on fair-dev
• Test new user onboarding
• Test existing user (legacy) onboarding with OSM account recovery
• Verify user mappings are created correctly

Note: Docker/deployment changes are in a separate PR.