Initial commit: content-driven onboarding portal

Leptos/Axum app that renders a Question/Alternative/Feature schema
loaded from a sibling content repo (portal-content). Kanidm OIDC login,
content-driven authorization (Question.qualifies), a generic NATS
KV-backed resource + state-transition mechanism (no bespoke "applicant"
concept baked into the runtime - it's all content), a SHA-256 DAG chain
tying submissions and decisions together, and the "YES - Rasterized
Lines" piece (ported from the live uhhm.no site) as the landing hero.

src/server/mod.rs

@@ -0,0 +1,30 @@
+#![cfg(feature = "ssr")]
+
+pub mod oidc;
+
+use axum::extract::FromRef;
+use leptos::prelude::LeptosOptions;
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use crate::content::Question;
+
+#[derive(Clone)]
+pub struct AppState {
+    pub leptos_options: LeptosOptions,
+    pub nats: async_nats::Client,
+    /// JetStream context - source of every NATS KV bucket this app
+    /// reads/writes (applicants, and whatever a `ResourceSpec` names).
+    pub jetstream: async_nats::jetstream::Context,
+    pub questions: Arc<HashMap<String, Question>>,
+    pub oidc: Arc<oidc::Oidc>,
+    /// `None` when `GARAGE_*` env vars aren't set - uploads are the one
+    /// optional feature, everything else works without Garage.
+    pub garage: Option<crate::upload::Garage>,
+}
+
+impl FromRef<AppState> for LeptosOptions {
+    fn from_ref(state: &AppState) -> Self {
+        state.leptos_options.clone()
+    }
+}