Implement NetKingdom identity shell for coulomb.social (CSOC-WP-0002)

Django scaffold aligned with the business delivery lane: tenant-keyed
Member model without passwords, identity app as sole OIDC/session
boundary, dev-claims login, authenticated /app/ shell, ADR-0001, and
tests. T01/T02/T05/T06 done; OIDC registration, real user-engine HTTP,
flex-auth, and packaging remain open.

coulomb_social/apps/identity/flex_auth.py

@@ -0,0 +1,33 @@
+"""flex-auth PEP port — fail-closed for sensitive actions when PDP missing."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from django.conf import settings
+
+
+@dataclass(frozen=True)
+class AuthzDecision:
+    allow: bool
+    reason: str
+    decision_id: str = ""
+
+
+def check(action: str, *, resource: str = "shell", subject: str = "") -> AuthzDecision:
+    """Decide whether `action` is allowed.
+
+    - shell:view is allowed for any authenticated principal (shell smoke).
+    - other actions require FLEX_AUTH_BASE_URL; until wired, deny.
+    """
+    if action == "shell:view":
+        return AuthzDecision(allow=True, reason="shell-view-authenticated")
+
+    if not settings.FLEX_AUTH_BASE_URL:
+        return AuthzDecision(
+            allow=False,
+            reason="flex-auth-not-configured-fail-closed",
+        )
+
+    # TODO(CSOC-WP-0002-T07): HTTP call to flex-auth PDP
+    return AuthzDecision(allow=False, reason="flex-auth-http-not-implemented")