Include auth_time in ID token. Switch from upsert -> find_and_create_by so we actually get sid values for consent on the creation of the record

app/controllers/concerns/authentication.rb

@@ -49,6 +49,9 @@ module Authentication
       user.sessions.create!(user_agent: request.user_agent, ip_address: request.remote_ip).tap do |session|
         Current.session = session
 
+        # Store auth_time in session for OIDC max_age support
+        session[:auth_time] = Time.now.to_i
+
         # Extract root domain for cross-subdomain cookies (required for forward auth)
         domain = extract_root_domain(request.host)