feat(auth): add Feishu OAuth2 login provider

[yhd4711499]

What

Adds Feishu (飞书/Lark) as an OAuth2 login provider alongside GitHub and GitLab. When OAUTH2_FEISHU_CLIENT_ID/OAUTH2_FEISHU_CLIENT_SECRET are configured, the login page automatically shows a Feishu button (the provider catalog is config-driven).

Why

Enterprise deployments need Feishu SSO. This was implemented and verified end-to-end against a real Feishu self-built app (QR login → callback → account provisioning → re-login dedup).

How

Feishu deviates from standard OAuth2, so the Spring oauth2Login pipeline is reused with three targeted customizations:

• Authorize endpoint: Feishu requires app_id instead of client_id and does not accept a scope parameter (scopes are configured on the open-platform app). SkillHubOAuth2AuthorizationRequestResolver rebuilds the authorization URI for the feishu registration only.
• Userinfo envelope: Feishu returns {code, msg, data} with errors reported as HTTP 200, which DefaultOAuth2UserService cannot consume. New ProviderOAuth2UserService extension point + FeishuOAuth2UserService unwrap data into flat attributes; OAuthLoginFlowService selects the loader per registrationId (GitHub/GitLab unchanged).
• Token endpoint: uses client_secret_post.
• Identity: binds on open_id (stable per app); union_id is kept in extra for potential cross-app migration. Email prefers enterprise_email over email; users without email are denied under the EMAIL_DOMAIN access policy (documented).

Also includes:

• web/public/feishu-logo.svg (the only frontend change; button rendering/i18n adapt automatically)
• .env.release.example and docs/03-authentication-design.md updates (Feishu as the non-standard provider integration template)
• Separate fix: SKILLHUB_TRUST_FORWARDED_PROTO was undefined in docker-compose.staging.yml, breaking make staging with an nginx "unknown variable" error (pre-existing on main)

Testing

• ./mvnw -pl skillhub-auth -am test: green (new FeishuOAuth2UserServiceTest, FeishuClaimsExtractorTest, resolver app_id/no-scope assertions)
• make typecheck-web, make lint-web: green
• make staging: green after the compose env fix
• E2E with a real Feishu app: login button visible, redirect carries app_id, callback provisions the account (display name + avatar synced), second login reuses the same binding (1 binding / 1 user)
• Note: ApiAccessDeniedHandlerTest has 2 pre-existing locale-dependent failures on this machine (fails on clean HEAD too, unrelated to this change)

Impact

• No breaking changes; Feishu stays hidden until real credentials are configured (placeholder client-id is filtered by AuthMethodCatalog)
• Operators: set OAUTH2_FEISHU_CLIENT_ID / OAUTH2_FEISHU_CLIENT_SECRET, grant contact:user.base:readonly + contact:user.email:readonly on the app, and register <base-url>/login/oauth2/code/feishu as a redirect URL

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}