Initial commit: content-driven onboarding portal

Leptos/Axum app that renders a Question/Alternative/Feature schema
loaded from a sibling content repo (portal-content). Kanidm OIDC login,
content-driven authorization (Question.qualifies), a generic NATS
KV-backed resource + state-transition mechanism (no bespoke "applicant"
concept baked into the runtime - it's all content), a SHA-256 DAG chain
tying submissions and decisions together, and the "YES - Rasterized
Lines" piece (ported from the live uhhm.no site) as the landing hero.

src/auth.rs

@@ -0,0 +1,30 @@
+use leptos::prelude::*;
+use serde::{Deserialize, Serialize};
+
+/// The authenticated user, as established by the Kanidm OIDC flow and
+/// stored in the server-side session. Ported from cnats' `auth.rs` -
+/// same shape, same provider.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct User {
+    pub sub: String,
+    pub username: String,
+    pub display_name: String,
+    /// Kanidm group membership, from the `groups` OIDC claim (see
+    /// `oauth2 update-claim-map`). Fixed at login time - not re-checked
+    /// live, so a group change only takes effect on the next login.
+    #[serde(default)]
+    pub groups: Vec<String>,
+}
+
+pub const SESSION_USER_KEY: &str = "user";
+
+/// Returns the currently signed-in user, if any.
+#[server]
+pub async fn current_user() -> Result<Option<User>, ServerFnError> {
+    let session: tower_sessions::Session = leptos_axum::extract().await?;
+    let user = session
+        .get::<User>(SESSION_USER_KEY)
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    Ok(user)
+}