## 1. Configuration and schema foundation

- [x] 1.1 Add auth/OIDC/JWT/cookie settings to backend config with environment-aware defaults.
- [x] 1.2 Add refresh token SQLAlchemy model and relationships to user model.
- [x] 1.3 Add Alembic migration for refresh token table and indexes.
- [x] 1.4 Add/adjust tests that fail first for config and refresh-token model metadata.

## 2. Auth provider and token services

- [x] 2.1 Implement Authentik OIDC client helpers for login URL build and callback token exchange.
- [x] 2.2 Implement JWKS-based token verification helper for provider tokens.
- [x] 2.3 Implement internal JWT mint/verify helper with configured TTL.
- [x] 2.4 Implement refresh token store service (hashing, create, rotate, revoke, reuse detection).
- [x] 2.5 Add unit tests for provider verification, JWT helpers, cookie options, and refresh lifecycle.

## 3. Auth HTTP endpoints

- [x] 3.1 Implement `GET /auth/login` redirect endpoint.
- [x] 3.2 Implement `GET /auth/callback` with state validation, token exchange, user upsert, and cookie set.
- [x] 3.3 Implement `POST /auth/refresh` with DB validation and rotation.
- [x] 3.4 Implement `POST /auth/logout` to revoke refresh state and clear cookies.
- [x] 3.5 Implement `GET /auth/me` returning authenticated user payload via internal JWT.
- [x] 3.6 Add integration tests for callback, refresh rotation, logout, and unauthorized cases.

## 4. Verification and OpenSpec tracking

- [x] 4.1 Run auth-focused and full backend checks (`pytest`, `ruff check`, `mypy`) and fix findings.
- [x] 4.2 Run migration verification against local Postgres and confirm current revision.
- [x] 4.3 Update this task list with completed checkboxes and note any blockers/follow-ups.

## Blockers / Follow-ups

- No blocking items remain for this change.

## Runtime verification

- `DATABASE_URL=postgresql+asyncpg://headquarter:headquarter@localhost:5432/headquarter .venv/bin/alembic -c alembic.ini upgrade head` succeeded.
- `DATABASE_URL=postgresql+asyncpg://headquarter:headquarter@localhost:5432/headquarter .venv/bin/alembic -c alembic.ini current` returned `0002_refresh_tokens (head)`.