## ADDED Requirements

### Requirement: User can authenticate via Authentik OIDC
The system SHALL provide an authentication flow using Authentik as the OIDC provider.

#### Scenario: Successful login
- **WHEN** an unauthenticated user clicks "Sign In"
- **THEN** the system redirects to Authentik's authorization endpoint with PKCE parameters
- **AND** after successful authentication, Authentik redirects back with an authorization code
- **AND** the system exchanges the code for tokens
- **AND** the user is redirected to the dashboard

#### Scenario: Automatic user provisioning
- **WHEN** a user authenticates for the first time
- **THEN** the backend creates a User record automatically
- **AND** the user can access their projects immediately

#### Scenario: Logout
- **WHEN** an authenticated user clicks "Sign Out"
- **THEN** the system clears all session data
- **AND** redirects to Authentik's end_session_endpoint
- **AND** the user is redirected back to the login page

### Requirement: Auth state is managed globally
The system SHALL maintain authentication state accessible throughout the application.

#### Scenario: Auth context available
- **WHEN** the application loads
- **THEN** an auth context provider wraps the component tree
- **AND** child components can read the current auth state (loading, authenticated, unauthenticated, error)

#### Scenario: Token refresh
- **WHEN** an API request returns 401 due to expired token
- **THEN** the system attempts token refresh
- **AND** retries the original request with the new token
- **AND** if refresh fails, redirects to login