[servicememeai]

Scope — unified CloudFile SSO delivery (absorbs #34)

This is the only PR to merge for canonical Etech UID-based login resolution across legacy OAuth2 and native V2 OIDC. PR #34 is superseded after extracting its valid changes. Branch rebased on current V2 dev; no dev2/V0.9 code is reintroduced.

Identity and native OIDC

• The immutable trusted business UID is Profile.login_id; preserve original native Profile.user, group grants, and file ownership.
• For a new verified OIDC issuer+sub with an already provisioned exact UID, check trusted Directory, active account and barriers; add only a second subject binding with existing SQL locks and transactional audit. No new user even if account-creation JIT is disabled.
• Keep existing JIT/pending policy when there is no UID account. Reject issuer/sub/UID collision, case-insensitive alias, inactive user, admin account or unavailable directory. No email/employee identity merge.

Selective fixes from #34

• Reuse upstream Seahub OAuth entrypoint and existing legacy provider/subject flow. Only when admin-configured trusted UserInfo userId -> login_id is present, use V2 legacy_oauth adapter for exact UID account selection before login; reject conflicting provider/sub, disabled account and unavailable configured Etech Directory.
• Preserve generic legacy OAuth (e.g., preferred_username -> login_id without trusted userId) unchanged; it is not automatically declared canonical Etech identity.
• Verify and consume OAuth state; if using /oidc/login/, validate nonce, ID Token issuer/signature/audience and UserInfo subject before linking.
• Fix a preexisting OAuth error-handler issue where unpacking profile, _ shadowed the gettext _() callable.
• Keep current dev restriction: CF_SSO_EAP_PROFILE_IDENTITY must not import retired V0.9 EAP OAuth bridge.

Checks and execution boundaries

• AST syntax checks for all 9 touched Python paths; git diff --check: passed.
• Four pure legacy UID/mapping tests: passed.
• Callback-source isolated smoke: strict UID reuse; rejected OAuth state without token fetch; unmapped old OAuth flow retained: passed.
• Existing Django callback tests updated; SQL/OIDC unit regressions included. Full Django/pytest/MariaDB tests and real DEV/Authentik/Etech browser/file-permission checks not executed on this host (no Django/pytest); merging source does not claim an end-to-end deployment.
• No DB schema change, Server/Docker patch, image build, or deployment. Routine PR checks are limited to lightweight source verification. Docker/PROD legacy mappings may still require explicit UID configuration review.

Documentation: SSO unified UID policy.

Final disposition: merge this PR to dev; close #34 as superseded without merging it.