Nachet make auth optional for local dev environments

## Context

Nachet Platform currently depends on Microsoft Entra and MSAL for authentication. That works for the Azure deployment, but it makes local development and future self-hosted deployments harder.

While we initially considered making authentication optional for local development, doing so risks hiding real bugs and weakening the security model because the platform state is tied to users, folders, RBAC, and shared backend data.

Nachet Mini can run without authentication because it runs entirely in the browser. Nachet Platform needs a real authentication path.

## Goal

Investigate and implement a provider-neutral OpenID Connect approach for local and self-hosted environments, while keeping the existing Microsoft Entra flow working.

## Scope

This issue tracks the full auth-provider work as an epic:

- Research the current Entra and MSAL flow
- Compare backend, frontend, and local provider options
- Decide how to handle local development without a broad auth bypass
- Implement the agreed frontend and backend changes in smaller PRs
- Add local provider setup, tests, and documentation

## Work items

- [x] Document the current frontend and backend authentication flow
- [x] Document what breaks or changes if authentication is turned off
- [x] Document the decision on mocking Entra
- [x] Compare backend validation options, frontend OIDC clients, and local identity providers
- [x] Decide on the first proof-of-concept provider
- [x] Agree on the implementation plan with the team
- [x] Frontend: introduce an auth abstraction or provider-neutral OIDC client. This will likely be the first implementation step because the current MSAL usage is Azure-specific.
- [x] Backend: support provider-neutral token validation
- [x] Local development: add or document a real OIDC provider setup
- [x] Tests: cover valid tokens, invalid tokens, auth states, and failure cases
- [x] Docs: explain how to run and test the local auth setup
- [x] Split implementation into smaller PRs

## Acceptance criteria

- Existing Microsoft Entra authentication still works.
- No staging or production environment can accidentally run without authentication.
- The team has a documented recommendation for local and self-hosted authentication.
- Backend token validation fails closed for invalid issuer, audience, expiry, signature, or configuration.
- Any selected library or provider is reviewed for maintenance, license, security posture, and fit with Nachet.
- Local development has either a working OIDC proof of concept or a clear follow-up plan.
- Frontend and backend changes are split into smaller PRs instead of one large cross-layer change.

## Open questions

- Which provider should be used for the first local proof of concept?
- Should the backend use an existing verifier, vendor a small verifier, or extend the current code?
- Which claims does Nachet require from every provider?
- Should this issue stay as the tracking issue while smaller issues and PRs handle implementation?