cnats: NATS-native chat with Leptos SSR and Kanidm SSO

Initial import plus deployment packaging: multi-stage Dockerfile
(cargo-leptos build -> debian-slim runtime), .dockerignore, and a
dev-only docker-compose (app + local NATS). Production deployment
lives in the infrastructure repo.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/auth.rs

@@ -0,0 +1,24 @@
+use leptos::prelude::*;
+use serde::{Deserialize, Serialize};
+
+/// The authenticated user, as established by the Kanidm OIDC flow and
+/// stored in the server-side session.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct User {
+    pub sub: String,
+    pub username: String,
+    pub display_name: String,
+}
+
+pub const SESSION_USER_KEY: &str = "user";
+
+/// Returns the currently signed-in user, if any.
+#[server]
+pub async fn current_user() -> Result<Option<User>, ServerFnError> {
+    let session: tower_sessions::Session = leptos_axum::extract().await?;
+    let user = session
+        .get::<User>(SESSION_USER_KEY)
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    Ok(user)
+}