Worker Portal Redesign — Stage 4: IDP loader + IDP-aware sign-in

# Existing — unchanged
default_role = "eligibility_worker"
[roles.eligibility_worker] ...

# NEW in Stage 4
[[idp]]
slug = "georgia-keycloak"             # ^[a-z0-9-]+$, unique; "synthetic-fallback" reserved
label = "Georgia DHS"
provider_type = "keycloak"            # keycloak | oidc-generic
issuer_url = "http://localhost:8088/realms/canopy"
internal_issuer_url = "http://keycloak:8080/realms/canopy"  # optional
client_id = "canopy-ui"
audience = "canopy"                   # REQUIRED, explicit; matches canopy-api/bootstrap.rs:135
chip_color = "primary"                # primary | accent | sage | gold | info | neutral
chip_icon = "keycloak"                # keycloak | shield | oidc-generic
domain_match = ["@georgia.gov", "@dhs.ga.gov"]

[local_accounts]
enabled = false

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct IdpDocument {
    pub default_role: String,
    pub roles: HashMap<String, RoleDef>,
    #[serde(default, rename = "idp")]
    pub idps: Vec<IdpEntry>,
    #[serde(default)]
    pub local_accounts: LocalAccountsConfig,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct IdpEntry {
    pub slug: String,
    pub label: String,
    pub provider_type: ProviderType,
    pub issuer_url: String,
    #[serde(default)]
    pub internal_issuer_url: Option<String>,
    pub client_id: String,
    /// Required (no `#[serde(default)]`). Must match the IdP's emitted JWT `aud` claim.
    /// No default to client_id; canopy-web uses client_id="canopy-ui" + audience="canopy".
    pub audience: String,
    pub chip_color: ChipColor,
    pub chip_icon: ChipIcon,
    #[serde(default)]
    pub domain_match: Vec<String>,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "kebab-case", deny_unknown_fields)]
pub enum ProviderType { Keycloak, OidcGeneric }

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "kebab-case", deny_unknown_fields)]
pub enum ChipColor { Primary, Accent, Sage, Gold, Info, Neutral }

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "kebab-case", deny_unknown_fields)]
pub enum ChipIcon { Keycloak, Shield, OidcGeneric }

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Default)]
#[serde(deny_unknown_fields)]
pub struct LocalAccountsConfig {
    #[serde(default)]
    pub enabled: bool,
}

impl std::fmt::Display for ChipColor { /* snake-case wire format */ }
impl std::fmt::Display for ChipIcon  { /* snake-case wire format */ }

impl IdpDocument {
    /// Parse + validate. Post-deserialize checks:
    ///   - every slug matches ^[a-z0-9-]+$ and is non-empty
    ///   - no slug == "synthetic-fallback" (reserved per Decision 9)
    ///   - slugs are unique across `idps`
    ///   - every `domain_match` pattern starts with `@`
    ///   - every `[[idp]]` audience is non-empty
    ///   - `default_role` is present in `roles` (existing invariant)
    /// Violations: IdpError::{SlugInvalid, SlugReserved, SlugDuplicate,
    ///                       DomainPatternInvalid, AudienceEmpty, DefaultRoleUnknown}.
    pub fn parse(toml_str: &str) -> Result<Self, IdpError>;
    pub fn discover(&self, email: &str) -> Option<&IdpEntry>;
    pub fn by_slug(&self, slug: &str) -> Option<&IdpEntry>;
    pub fn local_accounts_enabled(&self) -> bool;
    pub fn has_role(&self, role: &RoleSlug) -> bool; // existing
}

pub struct IdpRuntime {
    pub entries: Vec<IdpRuntimeEntry>,
    pub local_accounts_enabled: bool,
    pub redirect_url: String,
    pub fallback_active: bool,
}

pub struct IdpRuntimeEntry {
    pub meta: IdpEntry,
    pub external: Arc<OidcDiscovery>,
    pub internal: Arc<OidcDiscovery>,
    pub jwks: Arc<canopy_auth::jwks::JwksProvider>,
}

impl IdpRuntime {
    pub async fn build(
        idp_doc: &IdpDocument,
        web_config: &WebConfig,
        http: &reqwest::Client,
    ) -> Result<Self, IdpRuntimeError>;
    pub fn by_slug(&self, slug: &str) -> Option<&IdpRuntimeEntry>;
    pub fn all(&self) -> &[IdpRuntimeEntry];
    /// Proxies to IdpDocument::discover for lookup ordering parity.
    pub fn discover(&self, email: &str) -> Option<&IdpRuntimeEntry>;
    pub fn single_idp(&self) -> Option<&IdpRuntimeEntry>;  // Some iff entries.len() == 1
}

#[derive(Debug, thiserror::Error)]
pub enum IdpRuntimeError {
    #[error("OIDC discovery failed for issuer {issuer}: {source}")]
    Discovery { issuer: String, #[source] source: canopy_auth::AuthDiscoveryError },
    #[error("JWKS provider build failed for issuer {issuer}: {source}")]
    Jwks { issuer: String, #[source] source: reqwest::Error },
    #[error("JWKS warm-up refresh failed for issuer {issuer}: {source}")]
    JwksRefresh { issuer: String, #[source] source: anyhow::Error },
}

#[derive(askama::Template)]
#[template(path = "auth/sign_in.html")]
pub struct SignInPage {
    pub branding: BrandingConfig,
    pub is_sidebar: bool,    // ALWAYS `false` for sign-in
    pub active_nav: String,  // pass ""
    pub runtime: Arc<IdpRuntime>,
    pub matched_slug: Option<String>,
    pub return_to: Option<String>,
}

#[derive(askama::Template)]
#[template(path = "auth/_chip_list.html")]
pub struct ChipListFragment {
    pub runtime: Arc<IdpRuntime>,
    pub matched_slug: Option<String>,
    pub return_to: Option<String>,
}

#[derive(serde::Deserialize)]
pub struct SignInQuery { #[serde(default)] pub return_to: Option<String> }

#[derive(serde::Deserialize)]
pub struct DiscoverQuery {
    pub email: String,
    #[serde(default)] pub return_to: Option<String>,
}

#[derive(serde::Deserialize)]
pub struct SelectQuery {
    pub slug: String,
    #[serde(default)] pub return_to: Option<String>,
}

pub async fn sign_in_page(
    Extension(runtime): Extension<Arc<IdpRuntime>>,
    Extension(theme): Extension<Arc<ThemeConfig>>,
    Query(q): Query<SignInQuery>,
) -> Result<axum::response::Html<String>, axum::http::StatusCode>;

pub async fn discover(
    Extension(runtime): Extension<Arc<IdpRuntime>>,
    Query(q): Query<DiscoverQuery>,
) -> Result<axum::response::Html<String>, axum::http::StatusCode>;

pub async fn select(
    Extension(runtime): Extension<Arc<IdpRuntime>>,
    session: Session,
    Query(q): Query<SelectQuery>,
) -> axum::response::Response;  // Redirect on known slug; 404 with body on unknown.

pub async fn local_login_stub() -> (axum::http::StatusCode, axum::Json<serde_json::Value>);
// Wired as GET in main.rs: .route("/auth/local-login", get(local_login_stub))