Feat/mcdi auth

[ademboukabes]

Description

This PR introduces the integration of the MicroClub Digital Identity (MCDI) Single Sign-On (SSO) for the multAI-back application, while maintaining full backward compatibility for existing mobile authentication methods.

Features & Changes

• MCDI SSO Flow: Implemented a robust /mcdi/exchange endpoint for secure token exchange and session creation, supporting both mobile and web/staff clients.
• CSRF Protection: Enforced strict state and CSRF cookie validation across Starlette/FastAPI routes for secure OAuth transactions.
• Unified Auth Service: Refactored AuthService and UsersService to harmoniously handle both the legacy email/password/OTP mechanisms and the new MCDI OAuth flow.
• Rate Limiting & Caching: Leveraged Redis for caching MCDI token validations (to respect the 60 req/min upstream rate limit) and enforcing strict rate limits on authentication endpoints.

Backward Compatibility

• Legacy Routes Restored: The classic mobile authentication endpoints (/login, /register, /register/resend, /register/verify) remain intact and fully functional .
• Optional Dependencies: mcdi_service is injected gracefully, preventing service crashes for modules that do not rely on MCDI.

Testing

• Added 11 new comprehensive unit tests in tests/unit/test_mcdi_auth.py covering:
  • MCDI OAuth code exchange and caching mechanisms.
  • Successful token validation and profile matching.
  • Edge cases: token revocation, caching failures, account linking, and error propagation.
• Restored existing integration tests (tests/integration/*) which now successfully pass by virtue of the restored legacy endpoints.
• CI Status: 197 passed, 28 skipped, 8 warnings in 30.99s (All tests are strictly green).

---

*Note: This PR targets the develop branch.