feat(backend): add microsoft authentication

[nekrosb]

No description provided.

[greptile-apps]

Greptile Summary

This PR adds Laravel Socialite and the Microsoft Azure provider, registers the provider, introduces Microsoft OAuth routes and a callback controller, and documents the required environment variables.

• Registers the Azure Socialite driver.
• Adds redirect and callback endpoints.
• Restricts callbacks to a configured Microsoft tenant.
• Adds Socialite and Microsoft Azure dependencies.

How to test manually

After addressing the review findings:

1. Register https://<preview-host>/auth/microsoft/callback as a Web redirect URI in the Microsoft app registration.
2. Configure MICROSOFT_TENANT_ID, MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET, and MICROSOFT_REDIRECT_URI=https://<preview-host>/auth/microsoft/callback on the preview environment.
3. Open https://<preview-host>/auth/microsoft.
4. Sign in using an account from the configured tenant.
5. Verify the callback creates or resolves the expected local user, establishes a session, and leaves the user authenticated on the home page.
6. Repeat with an account from another tenant and verify the callback returns HTTP 403.
7. Log out and verify the protected home page is inaccessible again.

Confidence Score: 2/5

The PR is not safe to merge because users can neither start the Microsoft OAuth flow nor become authenticated after a successful callback.

The entry route dispatches a nonexistent controller method, and the callback redirects to an authenticated-only page without provisioning or logging in a local user; the example callback URI also cannot function as configured.

Files Needing Attention: routes/auth.php, app/Http/Controllers/Auth/MicrosoftAuthController.php, .env.example

Important Files Changed

Filename	Overview
routes/auth.php	Adds Microsoft OAuth routes, but the initial route references a controller method that does not exist.
app/Http/Controllers/Auth/MicrosoftAuthController.php	Adds Azure redirect and callback handling, but the callback never establishes an application session.
.env.example	Documents Microsoft credentials with a malformed, localhost-only callback URI.
config/services.php	Maps the four Microsoft OAuth environment variables into the Azure Socialite configuration.
app/Providers/AppServiceProvider.php	Registers the Azure provider when Socialite initializes.
composer.json	Adds Laravel Socialite and the Microsoft Azure provider dependencies.

Sequence Diagram

sequenceDiagram
    actor User
    participant App
    participant Microsoft
    participant Session

    User->>App: GET /auth/microsoft
    App->>Microsoft: OAuth authorization redirect
    Microsoft-->>App: GET /auth/microsoft/callback
    App->>Microsoft: Exchange code and load profile
    App->>App: Validate tenant
    App->>Session: Resolve local user and authenticate
    App-->>User: Redirect to protected home

Loading

Prompt To Fix All With AI

### Issue 1
routes/auth.php:6
**OAuth route targets missing method**

The Microsoft sign-in route targets `MicrosoftAuthController::redirect`, but the controller only defines `redirectToProvider`. A request to `/auth/microsoft` therefore fails while dispatching the nonexistent method, so users cannot begin the OAuth flow.

```suggestion
Route::get('/auth/microsoft', [MicrosoftAuthController::class, 'redirectToProvider'])
```

### Issue 2
app/Http/Controllers/Auth/MicrosoftAuthController.php:26
**Callback never authenticates user**

After a valid Azure callback passes the tenant check, the controller redirects to the protected home route without finding or creating a local user and without establishing an authenticated session. Because `home` requires the `auth` middleware, the user is sent back to the login page and Microsoft authentication never completes.

### Issue 3
.env.example:74
**Callback URI is invalid**

The example Microsoft callback URI is scheme-less (`localhost/auth/microsoft/callback`) and is passed directly to Socialite. An environment initialized from this example sends a non-absolute OAuth `redirect_uri`, which will not match a valid Azure app-registration callback and prevents Microsoft sign-in. The preview environment must use its complete HTTPS callback URL.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat(backend): add microsoft authenticat..." | Re-trigger Greptile}