feat: implement T11, T12 — Authelia adapter, privacyIDEA adapter

- T11: AutheliaAdapter delegating login UI and session; Authelia tokens never leak to profile layer
- T12: PrivacyIDEAAdapter delegating MFA 100% — no MFA logic in KeyCape

21 adapter tests pass, vet clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/internal/domain/auth.go

@@ -0,0 +1,45 @@
+package domain
+
+import (
+	"context"
+	"errors"
+)
+
+// AuthProvider handles login UI delegation and session management.
+// The server layer uses only this interface — no Authelia types leak out.
+type AuthProvider interface {
+	// AuthorizeURL returns the URL to redirect the user to for login.
+	AuthorizeURL(ctx context.Context, req AuthRequest) (string, error)
+
+	// HandleCallback extracts the authenticated user identity from a callback request.
+	// Returns ErrAuthFailed if authentication was not successful.
+	HandleCallback(ctx context.Context, callbackParams CallbackParams) (*AuthResult, error)
+}
+
+// AuthRequest contains the parameters for initiating an auth flow.
+type AuthRequest struct {
+	ClientID            string
+	RedirectURI         string
+	State               string
+	Nonce               string
+	Scopes              []string
+	PKCEChallenge       string
+	PKCEChallengeMethod string
+}
+
+// CallbackParams are the query params received on the redirect callback.
+type CallbackParams struct {
+	Code  string
+	State string
+	Error string
+}
+
+// AuthResult is the normalized identity returned after successful authentication.
+type AuthResult struct {
+	Username string
+	// Raw identity claims from the backend (not exposed to OIDC layer directly)
+	Claims map[string]interface{}
+}
+
+// ErrAuthFailed is returned by AuthProvider.HandleCallback when authentication was not successful.
+var ErrAuthFailed = errors.New("authentication failed")

src/internal/domain/mfa.go

@@ -0,0 +1,23 @@
+package domain
+
+import (
+	"context"
+	"errors"
+)
+
+// MFAProvider checks MFA requirements and validates MFA tokens.
+// KeyCape must NOT implement MFA logic — it delegates entirely to this interface.
+type MFAProvider interface {
+	// CheckMFARequired returns true if MFA is required for the given user.
+	CheckMFARequired(ctx context.Context, userID string) (bool, error)
+
+	// ValidateMFAToken validates the given OTP token for the user.
+	// Returns ErrMFAFailed if the token is invalid or expired.
+	ValidateMFAToken(ctx context.Context, userID, token string) error
+}
+
+// ErrMFAFailed is returned when the MFA token is invalid or expired.
+var ErrMFAFailed = errors.New("mfa validation failed")
+
+// ErrMFANotEnrolled is returned when the user has no MFA enrollment.
+var ErrMFANotEnrolled = errors.New("user has no MFA enrollment")