Auth for production: resolve the SSO fork (blocked on MIE)

[Taleef7]

Context

Hardcoded accounts (JWT + refresh rotation exist and are solid; the DIRECTORY is the gap). Three options: (a) MIE SSO/IdP, (b) WebChart-delegated auth, (c) standalone OIDC. Decision input = questions doc Q15. DO NOT build speculatively — record the fork, gather the answer, then spec.

What to do

1. Record the three-way auth fork (MIE SSO/IdP, WebChart-delegated auth, standalone OIDC) and the fact that the decision input is questions doc Q15.
2. Do NOT build speculatively — wait for MIE's answer to Q15 (via Send the MIE unblock package (WebChart API contract questions) + record answers #254).
3. Once the answer lands, record it in this issue, then open a follow-up spec issue for the chosen option (with its own acceptance criteria) and close this issue.

Acceptance criteria

• MIE answer to Q15 recorded here
• A follow-up spec issue created for the chosen option with its own AC (this issue then closes)

How to verify

1. Confirm this issue contains the recorded MIE answer to Q15 (dated).
2. Confirm a follow-up spec issue exists for the chosen auth option, carrying its own acceptance criteria.
3. Confirm this issue is closed once the follow-up spec issue is created.

Effort & dependencies

Effort: decision-only now. Dependencies: #254 (Issue 2).

Hard rules (repo-wide, non-negotiable)

• CQL Outcome Status is the SOLE compliance authority (ADR-008). Nothing you build may set, override, or shortcut it.
• Every state change writes an audit_events row. No exceptions.
• NO new npm dependencies unless the issue explicitly approves one; schema/DDL changes are owner-gated (Taleef only — stop and ask).
• Verify before claiming done: cd backend-ts && pnpm typecheck && pnpm test (expect ~1057+ pass / 1 pg-skip / 0 fail) and, if frontend touched, cd frontend && npm run lint && npm run build.
• Update affected docs (ARCHITECTURE/DATA_MODEL/MEASURES/DECISIONS/DEPLOY + JOURNAL.md entry) in the same PR. Conventional commits. Feature branch + PR; owner merges.

Links

• docs/ROADMAP_2026-07-09.md (lands in the roadmap docs PR)
• docs/MIE_INTEGRATION_QUESTIONS_2026-07-09.md (Q15)