feat(console): support Microsoft Entra ID through generic OIDC

[UditDewan]

Closes #1312

Summary

Adds documented and tested Microsoft Entra ID support through Jitsu's existing generic OIDC provider, without introducing a provider-specific authentication path.

Configuration

AUTH_OIDC_PROVIDER='{"issuer":"https://login.microsoftonline.com/<tenant-id>/v2.0","clientId":"<Application (client) ID>","clientSecret":"<Client secret value>"}'

Register this redirect URI in Entra:

<console origin>/api/auth/callback/oidc

For multi-tenant sign-in, use organizations for work/school accounts or common for work/school and personal Microsoft accounts.

The Entra application must return a usable email claim. Jitsu intentionally does not substitute preferred_username, because Microsoft does not guarantee that claim is an email address and Jitsu uses email for invitations.

Changes

• documents Entra configuration via AUTH_OIDC_PROVIDER
• normalizes trailing slashes before OIDC discovery
• enables the login UI only when the OIDC JSON parses successfully
• models optional OIDC profile claims accurately
• adds unit coverage for tenant-specific and multi-tenant Entra issuers, provider settings, email mapping, and invalid config

Validation

• pnpm exec vitest run --project unit — 31 tests passed
• pnpm --filter @jitsu-internal/console typecheck
• pnpm --filter @jitsu-internal/console lint — no errors
• Prettier check

[vklimontovich]

Thank you for the PR! Does Azure implements OAuth2? We have OAuth2 impl which covers most of the login providers I believe. We don't want to introduce dedicated config / code path for every provider

[UditDewan]

@vklimontovich Thanks — you were right that Entra fits the existing OIDC provider. I’ve reworked the PR to remove the dedicated Azure provider, configuration, and UI path and use AUTH_OIDC_PROVIDER instead.

The branch is also rebased onto the current newjitsu. The revised change documents the Entra issuer and callback, normalizes OIDC discovery URLs, avoids enabling OIDC for unusable JSON configuration, and adds coverage for tenant-specific and common Entra issuers.

I also removed the previous preferred_username fallback: Entra does not guarantee that it is an email address, and Jitsu uses email for invitations, so the configuration now explicitly requires a usable email claim.

Validation: 31 unit tests, console typecheck, and console lint (no errors). Ready for another look.