frontend/backend login via Zitadel provider

[JohnRDOrazio]

It would be useful to enable login with passkeys via Zitadel. This would also enable us to allow logins for both the frontend and the backend, using the same user accounts. It would be useful in the future to enable some frontend curation tools, such as adding Team Members, which would make the API calls to the wordpress backend. Then we wouldn't have to rely only on a command line client library.

[JohnRDOrazio]

Implementation plan documented: docs/zitadel-oidc-plan.md

Phase 1 — Zitadel + WordPress OIDC:

• Add Zitadel + PostgreSQL to Docker Compose
• Install openid-connect-generic plugin for "Login with OpenID Connect" button on wp-login
• Enable passkey (WebAuthn) authentication via Zitadel
• Application Passwords remain unaffected

Phase 2 — Next.js Frontend Auth:

• Auth.js v5 with Zitadel OIDC provider
• Role-based access control via Zitadel project roles
• Bearer token validation in WordPress for authenticated REST API calls from Next.js
• Enables future frontend curation tools (e.g. adding team members from the website)

Production: Zitadel at auth.catholicdigitalcommons.org, with OIDC callbacks registered for both cms.* and staging.* subdomains.

See the doc for full file-by-file implementation details, environment variables, and verification steps.