feat(security): design OIDC and SAML SSO integration path [BACKLOG]

[however-yir]

Problem

Enterprise teams often need KnowledgeOps Agent to integrate with existing identity providers instead of managing only API keys and local JWT flows.

Status: BACKLOG

Not implementing in current cycle. Requires:

• Enterprise IdP test accounts (Okta, Azure AD, Keycloak)
• Spring Security OAuth2 Client is already a dependency (pom.xml) but full SAML support needs spring-security-saml2-service-provider
• Multi-tenant OIDC claim mapping design

Deferred until

• At least one enterprise customer requests SSO
• Tenant RBAC model is finalized
• Security review of token storage and session management

Original scope

• Document target OIDC/SAML authentication flows.
• Define how external identities map to tenants, roles, and permissions.
• Identify Spring Security configuration changes and migration risks.

Acceptance criteria

• Architecture notes are added under docs/.
• Tenant and RBAC mapping strategy is documented.
• Implementation tasks are split into follow-up issues.

[however-yir]

Update: Design docs verified

Acceptance criteria status:

• Architecture notes added under docs/ → docs/enterprise-sso.md (OIDC/SAML config, user provisioning flow, Spring Security integration)
• Tenant and RBAC mapping strategy documented → external IdP identity maps to tenant + role, JWT issued with tenant-scoped claims, API-key auth continues for service accounts
• Implementation tasks captured → roadmap items list: OIDC Relying Party via spring-boot-starter-oauth2-client, IdP group → RBAC role mapping, SAML SP metadata endpoint, Azure AD/Okta quick-start configs

Design phase is complete. Implementation deferred to follow-up issues as scoped.

[raxh64]

@however-yir

致维护者，

我注意到项目Star数据近期出现了一些值得关注的变化。为保持讨论的建设性，我将按"现象-分析-建议"的结构来组织内容。

现象层面：Star 总量在不到一周内增长了约三到四倍。日均新增Star数远超历史平均水平。增长期间无重大版本发布或外部推广事件。

分析层面：对新增stargazer进行随机抽样后发现，这些账号普遍具备以下特征——注册时间短、公开活动少、社交连接弱。这些特征组合在fake star检测领域被视为强烈的阳性信号。

建议层面：

1. 主动对Star列表进行审计，识别并移除可疑账号
2. 就此事向社区做出公开透明的说明
3. 考虑向GitHub Trust & Safety提交相关报告
4. 制定长期的社区增长策略，以内容和互动驱动真实关注

以上供参考。期待一个积极的回应。
违规清晰可见，举报交 GitHub，违规流量清除，项目随后关停。