feat(auth): bring opaque (RFC 9807) auth

OPAQUE (RFC 9807) implementation (using `opaque-ke` crate)

    with opaque authentfication, server will never receive the password (in the auth=password mode)
    this is a must have to create trust with users to permit end to end encryption in the future
    (we cannot know if user use the same password/passphrase for his asymetric key or his oxicloud auth,
    this is why server must never have the password)

    pass1: prepare server

src/bin/opaque-setup.rs

@@ -0,0 +1,34 @@
+//! `opaque-setup` — one-shot operator helper that mints a fresh
+//! [`opaque_ke::ServerSetup`] and prints its base64 encoding to stdout.
+//!
+//! The output goes into `OXICLOUD_OPAQUE_SERVER_SETUP` (env var or secrets
+//! manager) and MUST be persisted verbatim. Rotating it invalidates every
+//! user's registration — treat it like the JWT secret, only more so.
+//!
+//! Usage:
+//! ```text
+//! cargo run --bin opaque-setup > opaque_setup.b64
+//! # or paste directly into your env / .env file:
+//! echo "OXICLOUD_OPAQUE_SERVER_SETUP=$(cargo run --bin opaque-setup)" >> .env
+//! ```
+//!
+//! The generated value is a small (~64 byte) Ristretto255 keypair
+//! serialised for storage. Nothing else — no config file, no key
+//! rotation state. Idempotent per invocation (each run generates a
+//! DIFFERENT value; only run it once per deployment).
+
+use oxicloud::infrastructure::services::opaque_service::OpaqueService;
+
+fn main() {
+    let b64 = OpaqueService::generate_server_setup_b64();
+    // Print JUST the value — no trailing newline commentary — so shell
+    // pipelines (`OXICLOUD_OPAQUE_SERVER_SETUP=$(cargo run --bin opaque-setup)`)
+    // capture cleanly without needing `tr -d '\n'` afterwards.
+    println!("{b64}");
+    // Guidance goes to stderr so it doesn't contaminate the pipeline.
+    eprintln!();
+    eprintln!("=== OPAQUE server setup generated. ===");
+    eprintln!("Persist the line above in OXICLOUD_OPAQUE_SERVER_SETUP.");
+    eprintln!("NEVER rotate: rotating invalidates every user's registration.");
+    eprintln!("Treat this value like your JWT secret.");
+}