Matt Mabrey
a9e5ee3892
Adds GET /api/auth/okta/login (redirect to Okta's authorize endpoint) and GET /api/auth/okta/callback (exchange code, validate ID token, pull the identity claim) to server/app.py, using the oauth.okta client from okta_auth.py (T10.1). Access gating is Okta's job, not this route's: only accounts assigned to the app integration in Okta ever reach the callback, so there is no app-side group/claim check layered on top (D15, wave-10.md T10.2). Stops at NotImplementedError once the identity claim is in hand. Matching that claim to a local account and issuing the session cookie is T10.3, kept separate per the one-task-per-PR rule. wave-10.md T10.2 / D15