Integrate central SSO and Pior Labs design system

[iPior]

Summary

• switches the Finance web app to @pior-labs/design-system@1.0.1
• authenticates GitHub Packages securely in CI and Docker builds with a BuildKit secret
• adds the auth-pior generic OAuth/OIDC provider and the Finance SSO login flow
• preserves local email/password login during production validation
• explicitly links the trusted central-auth identity to an existing Finance user with the same email
• resolves the old branch against the current platform-edge Compose configuration
• removes unrelated agent-skill files from the branch diff

Production integration

• retains the finance-api and finance-web aliases on the external pior_edge network
• retains the existing Finance database configuration and migrations
• validates all required CENTRAL_AUTH_* variables without printing secret values
• verifies the OIDC discovery issuer before migrations and restart
• verifies the API/web containers and both Finance hostnames through platform Caddy on port 443

Required FINLENS_ENV values

CENTRAL_AUTH_DISCOVERY_URL=https://auth.ts.szarans.ca/.well-known/openid-configuration
CENTRAL_AUTH_ISSUER=https://auth.ts.szarans.ca
CENTRAL_AUTH_CLIENT_ID=finlens
CENTRAL_AUTH_CLIENT_SECRET=<same value as service-auth FINLENS_CLIENT_SECRET>

BETTER_AUTH_URL=https://finance.ts.szarans.ca
BETTER_AUTH_TRUSTED_ORIGINS=https://finance.ts.szarans.ca,https://finance.szarans.ca

BETTER_AUTH_SECRET remains Finance-specific and must not be replaced with the OAuth client secret.

Validation before removing local login

• back up the current Finance database
• note the existing Finance user ID and email
• log in through Pior Labs SSO with the same email
• confirm the auth-pior account is linked to the existing Finance user
• confirm historical transactions and categories are visible
• test logout and both Finance hostnames

Intentionally excluded

• migration to the platform-managed Finance PostgreSQL database
• removal of local email/password login
• removal of localhost-published Finance ports