Massive refactor. Merge forward_auth into App, remove references to unimplemented OIDC federation and SAML features. Add group and user custom claims. Groups now allocate which apps a user can use

app/models/user.rb

@@ -3,8 +3,6 @@ class User < ApplicationRecord
   has_many :sessions, dependent: :destroy
   has_many :user_groups, dependent: :destroy
   has_many :groups, through: :user_groups
-  has_many :user_role_assignments, dependent: :destroy
-  has_many :application_roles, through: :user_role_assignments
   has_many :oidc_user_consents, dependent: :destroy
 
   # Token generation for passwordless flows
@@ -97,6 +95,11 @@ class User < ApplicationRecord
     oidc_user_consents.destroy_all
   end
 
+  # Parse custom_claims JSON field
+  def parsed_custom_claims
+    custom_claims || {}
+  end
+
   private
 
   def generate_backup_codes