feat: simplify auth flow - replace JWT with session cookies

Replace complex JWT + refresh token authentication with simple
session-based auth using signed cookies.

**Removed:**
- JWT token service (jwt_service.py)
- Refresh token store (refresh_store.py)
- Refresh token model and database table
- JWKS fetching and OIDC token verification
- python-jose dependency

**Added:**
- Session service (session.py) with HMAC-SHA256 signed cookies
- Auth dependencies module for shared auth logic
- Session-based auth endpoints

**Updated:**
- All API endpoints to use session-based auth
- Config: removed JWT settings, added SESSION_SECRET/SESSION_TTL_HOURS
- Tests: rewritten for session-based flow
- Frontend: no changes needed (already uses cookies)

Quality gates: ruff ✓, mypy ✓, typecheck ✓, lint ✓

openspec/changes/simplify-authentik-auth/tasks.md

@@ -0,0 +1,76 @@
+# Simplify Authentik Auth - Tasks
+
+## Phase 1: Remove Old Auth Code
+
+- [ ] **Task 1.1**: Remove JWT service (`src/auth/jwt_service.py`)
+  - Delete file
+  - Remove all imports and usages
+  
+- [ ] **Task 1.2**: Remove refresh token store (`src/auth/refresh_store.py`)
+  - Delete file
+  - Remove refresh token model (`src/models/refresh_token.py`)
+  - Remove table in Alembic migration
+  
+- [ ] **Task 1.3**: Remove complex OIDC logic
+  - Simplify `src/auth/oidc.py` to basic OAuth2 flow
+  - Remove JWKS fetching
+  - Remove token verification
+  
+- [ ] **Task 1.4**: Clean up auth dependencies
+  - Remove `python-jose` from dependencies if no longer needed
+  - Update `pyproject.toml`
+
+## Phase 2: Implement Session Auth
+
+- [ ] **Task 2.1**: Create session service (`src/auth/session.py`)
+  - Session cookie creation/signing
+  - Session cookie parsing/verification
+  - Session expiry handling
+  
+- [ ] **Task 2.2**: Update auth endpoints (`src/api/auth.py`)
+  - Simplify login endpoint
+  - Update callback to create session instead of JWT
+  - Update /me to read from session
+  - Simplify logout
+  
+- [ ] **Task 2.3**: Update auth middleware
+  - Replace JWT middleware with session middleware
+  - Load user from database based on session
+  
+- [ ] **Task 2.4**: Update configuration
+  - Remove JWT config
+  - Add SESSION_SECRET and SESSION_TTL_HOURS
+  - Update .env.example
+  - Update docker-compose configs
+
+## Phase 3: Update Frontend
+
+- [ ] **Task 3.1**: Remove JWT handling from frontend
+  - Delete token refresh logic
+  - Remove access token storage
+  
+- [ ] **Task 3.2**: Update auth API client
+  - Remove refresh endpoint calls
+  - Simplify auth state management
+  
+- [ ] **Task 3.3**: Update protected route logic
+  - Check session cookie instead of JWT
+  - Simpler auth state
+
+## Phase 4: Testing & Cleanup
+
+- [ ] **Task 4.1**: Update auth tests
+  - Rewrite tests for new session-based flow
+  - Remove JWT-specific tests
+  - Add session validation tests
+  
+- [ ] **Task 4.2**: Run quality gates
+  - ruff check
+  - mypy
+  - pytest
+  - frontend typecheck + lint + build
+  
+- [ ] **Task 4.3**: Documentation
+  - Update README with new auth flow
+  - Update deployment docs
+  - Document configuration changes