feat(15-02): install OIDC deps, rewrite auth middleware and service

- Install @hono/oidc-auth and jose for OIDC integration
- Rewrite requireAuth middleware with three-way auth: API key, MCP Bearer, OIDC session
- Strip auth.service.ts to API key functions only (remove user/session management)
- Remove all references to getUserCount, getSession, refreshSession from middleware

src/server/services/auth.service.ts

@@ -1,111 +1,10 @@
 import { randomBytes } from "node:crypto";
-import { count, eq } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import { db as prodDb } from "../../db/index.ts";
-import { apiKeys, sessions, users } from "../../db/schema.ts";
+import { apiKeys } from "../../db/schema.ts";
 
 type Db = typeof prodDb;
 
-// ── User Management ──────────────────────────────────────────────────
-
-export async function createUser(
-	db: Db = prodDb,
-	username: string,
-	password: string,
-) {
-	const passwordHash = await Bun.password.hash(password);
-	return db.insert(users).values({ username, passwordHash }).returning().get();
-}
-
-export async function verifyPassword(
-	db: Db = prodDb,
-	username: string,
-	password: string,
-) {
-	const user = db
-		.select()
-		.from(users)
-		.where(eq(users.username, username))
-		.get();
-
-	if (!user) return null;
-
-	const valid = await Bun.password.verify(password, user.passwordHash);
-	return valid ? user : null;
-}
-
-export function getUserCount(db: Db = prodDb): number {
-	const result = db.select({ value: count() }).from(users).get();
-	return result?.value ?? 0;
-}
-
-export async function changePassword(
-	db: Db = prodDb,
-	username: string,
-	currentPassword: string,
-	newPassword: string,
-): Promise<boolean> {
-	const user = await verifyPassword(db, username, currentPassword);
-	if (!user) return false;
-
-	const newHash = await Bun.password.hash(newPassword);
-	db.update(users)
-		.set({ passwordHash: newHash })
-		.where(eq(users.id, user.id))
-		.run();
-
-	return true;
-}
-
-// ── Session Management ───────────────────────────────────────────────
-
-export function createSession(
-	db: Db = prodDb,
-	userId: number,
-	expiryDays = 30,
-) {
-	const id = randomBytes(32).toString("hex");
-	const expiresAt = new Date(Date.now() + expiryDays * 24 * 60 * 60 * 1000);
-
-	return db
-		.insert(sessions)
-		.values({ id, userId, expiresAt })
-		.returning()
-		.get();
-}
-
-export function getSession(db: Db = prodDb, sessionId: string) {
-	const session = db
-		.select()
-		.from(sessions)
-		.where(eq(sessions.id, sessionId))
-		.get();
-
-	if (!session) return null;
-
-	if (session.expiresAt < new Date()) {
-		db.delete(sessions).where(eq(sessions.id, sessionId)).run();
-		return null;
-	}
-
-	return session;
-}
-
-export function deleteSession(db: Db = prodDb, sessionId: string) {
-	db.delete(sessions).where(eq(sessions.id, sessionId)).run();
-}
-
-export function refreshSession(
-	db: Db = prodDb,
-	sessionId: string,
-	expiryDays = 30,
-) {
-	const expiresAt = new Date(Date.now() + expiryDays * 24 * 60 * 60 * 1000);
-	db.update(sessions)
-		.set({ expiresAt })
-		.where(eq(sessions.id, sessionId))
-		.run();
-}
-
 // ── API Key Management ───────────────────────────────────────────────
 
 export async function createApiKey(db: Db = prodDb, name: string) {