docs: document session management and OIDC state transfer

[Copilot]

Context

Documents the Redis-backed session architecture used for OIDC and OAuth authentication flows. Answers: What handles server sessions? How is organization slug preserved across IDP redirects?

Key points:

• Sessions: @fastify/session + connect-redis with 10min TTL
• OIDC flow: orgSlug → Redis session → callback retrieval → config lookup → session destruction
• Security: session regeneration, cookie signing, HTTPS enforcement, ephemeral state

Files added:

• backend/docs/SESSION_MANAGEMENT.md - Complete architecture, flows, security model
• backend/docs/SESSION_QUICK_REFERENCE.md - Quick lookup for common questions
• backend/docs/README.md - Documentation index

Example from OIDC flow:

// Login: store org slug in Redis session
await req.session.regenerate();
req.session.set("oidcOrgSlug", orgSlug);

// Callback: retrieve slug to fetch org-specific config
const oidcOrgSlug = req.session.get("oidcOrgSlug");
const strategy = await getOrgAuthStrategy(oidcOrgSlug);

// Cleanup: destroy ephemeral session
await req.session.destroy();

Screenshots

N/A

Steps to verify the change

Review documentation in backend/docs/ directory.

Type

• Fix
• Feature
• Improvement
• Breaking
• Docs
• Chore

Checklist

• Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
• Tested locally
• Updated docs (if needed)
• Read the contributing guide

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[maidul98]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.