Redesign auth: Auth0-managed sessions replace self-minted JWTs

[baely]

What

Auth0 was only consulted at the moment of login — the callback verified the ID token, then minted a home-grown 30-day HS256 JWT signed with a static SIGNING_KEY. Nothing could refresh or revoke a login, and logout just dropped the cookie.

Auth0 now manages the login token lifecycle:

• Login requests the offline_access scope, so Auth0 issues a rotating refresh token alongside the ID token.
• The cookie holds only an opaque session ID; the Auth0 token set lives server-side in Redis (internal/auth/session.go) with a 30-day absolute lifetime, matching Auth0's default refresh-token expiry.
• When the token expires, the session refreshes against Auth0 — revoking a user's grant at Auth0 ends their session at the next refresh. Concurrent refreshes single-flight through a Redis lock so the rotated token isn't burned; refreshed ID tokens are verified and subject-checked, and calls to Auth0 carry a 10s timeout.
• Logout revokes the refresh token at Auth0's revocation endpoint and deletes the session, on both /logout and /auth/logout.
• The HS256 JWT machinery, SIGNING_KEY config and golang-jwt dependency are removed. Session cookies are now Secure on https and SameSite=Lax. API secrets and the mobile native exchange are unchanged.

Deployment notes

• The prod Auth0 application needs the Refresh Token grant enabled (rotation recommended). Without it the app still works but sessions end when the access token expires (a warning is logged). The local OIDC mock now sets AllowOfflineAccess: true.
• Everyone re-logs in once — old JWT cookies no longer resolve and are cleared cleanly.
• SIGNING_KEY is no longer read. The deploy workflows still inject it (harmless); left for a later clean-up since fix: stats-collector secret names + render last-updated in Melbourne time #246 has pending workflow changes.

Verification

• go build, go vet, full go test ./... green; new unit tests cover session round-trip, refresh + rotation, refused refresh, concurrent-refresh coordination and logout revocation against a fake Auth0 tenant.
• Verified live end-to-end against an isolated OIDC mock with a deliberately short 10-second token lifetime: browser login → Redis session with refresh token → real refresh-token grants with rotation persisted → logout produced "Token revocation complete" on the provider and deleted the session. Stale/garbage cookies are cleared and bounce to the hero page.

🤖 Generated with Claude Code