fix: fetch OIDC discovery before building authorization URL (#91)

get_authorize_url() was synchronous and fell back to constructing
{issuer}/authorize when the discovery cache was empty. This produced
incorrect URLs for providers like Keycloak whose authorization
endpoint is {issuer}/protocol/openid-connect/auth.

Made get_authorize_url() async so it can call get_discovery() to
fetch the real authorization_endpoint from .well-known/openid-configuration
before the first redirect. The discovery document is cached after the
initial fetch.

src/application/ports/auth_ports.rs

@@ -138,7 +138,8 @@ pub struct OidcIdClaims {
 pub trait OidcServicePort: Send + Sync + 'static {
     /// Get the authorization URL for redirecting the user to the IdP.
     /// Includes PKCE code_challenge (S256) and nonce for ID token binding.
-    fn get_authorize_url(&self, state: &str, nonce: &str, pkce_challenge: &str) -> Result<String, DomainError>;
+    /// This is async because it may need to fetch the OIDC discovery document.
+    async fn get_authorize_url(&self, state: &str, nonce: &str, pkce_challenge: &str) -> Result<String, DomainError>;
 
     /// Exchange an authorization code for tokens, providing PKCE code_verifier.
     async fn exchange_code(&self, code: &str, pkce_verifier: &str) -> Result<OidcTokenSet, DomainError>;

src/application/services/auth_application_service.rs

@@ -785,7 +785,7 @@ impl AuthApplicationService {
 
     /// Prepare the OIDC authorization flow: generates CSRF state, PKCE pair,
     /// nonce, stores them in pending_oidc_flows, and returns the authorize URL.
-    pub fn prepare_oidc_authorize(&self) -> Result<String, DomainError> {
+    pub async fn prepare_oidc_authorize(&self) -> Result<String, DomainError> {
         let oidc = self.oidc_service().ok_or_else(|| DomainError::new(
             ErrorKind::InternalError, "OIDC", "OIDC service not configured",
         ))?;
@@ -826,7 +826,7 @@ impl AuthApplicationService {
         }
 
         // Build authorization URL with state, nonce, and PKCE challenge
-        let authorize_url = oidc.get_authorize_url(&state_token, &nonce, &pkce_challenge)?;
+        let authorize_url = oidc.get_authorize_url(&state_token, &nonce, &pkce_challenge).await?;
 
         tracing::info!("OIDC authorize flow prepared (state={}...)", &state_token[..8]);