Add OAuth login flow for admin dashboard

[adrw]

Summary

• Adds kairo-admin module: a full-featured admin dashboard for Kairo servers
• Adds kairo-kdocs module: serves Dokka-generated API docs at /_kdocs
• Adds OAuth 2.0 Authorization Code flow for admin dashboard login
• Adds cookie-based browser auth via AuthReceiver.BearerTokenOverride

OAuth login flow

1. User visits /_admin/ → no cookie → auth fails → redirect to /_admin/login
2. /_admin/login → generates CSRF state cookie → redirects to OAuth provider (e.g. Auth0)
3. User authenticates → provider redirects to /_admin/callback?code=...&state=...
4. Server validates state, exchanges code for JWT access token, sets kairo_admin_token HttpOnly cookie
5. Redirect to /_admin/ → cookie present → verify() succeeds via BearerTokenOverride

Key changes

kairo-admin (new module)

• AdminDashboardFeature — Kairo feature with HTML dashboard, OAuth routes, and data collectors
• AdminOAuthConfig — Generic OAuth 2.0 config (authorizeUrl, tokenUrl, clientId, clientSecret, scopes, audience, providerName, logoutUrl)
• AdminDashboardHandler — Routes: GET /login (start OAuth), GET /callback (exchange code), POST /logout (clear cookie), plus authGet/authPost wrappers that redirect to login on auth failure
• LoginView — Error page shown only when OAuth is not configured; when configured, /login redirects directly to provider

kairo-kdocs (new module)

• KdocsFeature — Serves Dokka HTML docs from the classpath at /_kdocs

kairo-rest (modified)

• AuthReceiver.kt — Added BearerTokenOverride attribute key so admin dashboard can supply JWT from cookie instead of Authorization header; added forCall() factory for non-endpoint auth checks

Consumer code

AdminDashboardFeature(
  config = AdminDashboardConfig(
    serverName = "AI",
    oauth = AdminOAuthConfig(
      authorizeUrl = "https://auth.example.com/authorize",
      tokenUrl = "https://auth.example.com/oauth/token",
      clientId = "...",
      clientSecret = "...",
      providerName = "Auth0",
    ),
  ),
  auth = { superuser() },
),
KdocsFeature(),

Test plan

• Verify /_admin/ without cookie redirects to /_admin/login
• Verify /_admin/login redirects to OAuth provider with correct params
• Verify callback exchanges code for token and sets session cookie
• Verify /_admin/ with valid cookie loads the dashboard
• Verify /_admin/logout clears cookie
• Verify CSRF state validation rejects tampered state
• Verify Authorization: Bearer header still works for API access
• Verify /_kdocs serves Dokka docs

🤖 Generated with Claude Code