backstage-authlisted

# Backstage Authentication and Identity Wire an identity provider into Backstage, map its users onto catalog entities, and tell apart the five ways sign-in fails. ## Preconditions - Release line from `backstage.json`. Backend generation: `createBackend()` + `backend.add(import('@backstage/plugin-auth-backend'))` is the new backend system; a `createRouter` in `packages/backend/src/plugins/auth.ts` is legacy — migrate it before adding auth modules. - Frontend generation: `SignInPageBlueprint` from `@backstage/plugin-app-react` + `createFrontendModule` is NFS; a `components: { SignInPage }` option on `createApp` from `@backstage/app-defaults` is legacy. - Which provider is meant for **sign-in** and which only **delegates access to third-party APIs**. These are different jobs on the same config tree and most misconfigurations start here. - Exact factory and resolver signatures (`createOAuthProviderFactory`, `createProxyAuthProviderFactory`, `authProvidersExtensionPoint`, the `ctx` helpers) read from the installed `@backstage/plugin-auth-node` types, not from memory. - Anything requiring a new OAuth app registration, a client-secret rotation, or an IdP-side change is external mutation: stop and return a BLOCKED report with the exact redirect URI and scopes needed. ## Procedure 1. **Inventory before changing.** Read every `auth:` block across `app-config.yaml`, `app-config.production.yaml` and local overrides, the auth imports in `packages/backend/src/index.ts`, and the app's