feat(auth): интегрировать SSO auth-portal

JWT на backend, handoff/callback на UI, RBAC mm:*, AUTH_* в compose.

Co-authored-by: Cursor <cursoragent@cursor.com>

hooks/use-app-switcher.ts

@@ -8,6 +8,21 @@ import {
   parseAppSwitcherConfig,
   type AppSwitcherConfig,
 } from "@/lib/app-switcher-config"
+import {
+  ensureAuthConfig,
+  getAuthConfigSync,
+  getClaims,
+} from "@/lib/auth"
+
+function filterByJwtApps(config: AppSwitcherConfig): AppSwitcherConfig {
+  const claims = getClaims()
+  if (!claims?.apps?.length) return config
+  const allowed = new Set(claims.apps)
+  const apps = config.apps.filter(
+    (a) => a.id === "mm" || allowed.has(a.id),
+  )
+  return { ...config, apps: apps.length > 0 ? apps : config.apps }
+}
 
 export function useAppSwitcherConfig(): {
   config: AppSwitcherConfig
@@ -16,31 +31,43 @@ export function useAppSwitcherConfig(): {
   const [config, setConfig] = useState<AppSwitcherConfig>(() =>
     mergeWithLocalApp(DEFAULT_APP_SWITCHER_CONFIG),
   )
-  const [isLoading, setIsLoading] = useState(Boolean(authPortalBaseUrl()))
+  const [isLoading, setIsLoading] = useState(true)
 
   useEffect(() => {
-    const base = authPortalBaseUrl()
-    if (!base) {
-      setConfig(mergeWithLocalApp(DEFAULT_APP_SWITCHER_CONFIG))
-      setIsLoading(false)
-      return
-    }
-
     let cancelled = false
-    setIsLoading(true)
-    fetch(`${base}/api/v1/app-switcher`)
-      .then((res) => (res.ok ? res.json() : Promise.reject()))
-      .then((raw: unknown) => {
+
+    void (async () => {
+      await ensureAuthConfig()
+      if (cancelled) return
+
+      const portal =
+        getAuthConfigSync()?.portalUrl || authPortalBaseUrl() || null
+      if (!portal) {
+        setConfig(filterByJwtApps(mergeWithLocalApp(DEFAULT_APP_SWITCHER_CONFIG)))
+        setIsLoading(false)
+        return
+      }
+
+      setIsLoading(true)
+      try {
+        const res = await fetch(`${portal}/api/v1/app-switcher`)
+        if (!res.ok) throw new Error("switcher fetch failed")
+        const raw: unknown = await res.json()
         if (cancelled) return
         const parsed = parseAppSwitcherConfig(raw)
-        setConfig(mergeWithLocalApp(parsed ?? DEFAULT_APP_SWITCHER_CONFIG))
-      })
-      .catch(() => {
-        if (!cancelled) setConfig(mergeWithLocalApp(DEFAULT_APP_SWITCHER_CONFIG))
-      })
-      .finally(() => {
+        setConfig(
+          filterByJwtApps(mergeWithLocalApp(parsed ?? DEFAULT_APP_SWITCHER_CONFIG)),
+        )
+      } catch {
+        if (!cancelled) {
+          setConfig(
+            filterByJwtApps(mergeWithLocalApp(DEFAULT_APP_SWITCHER_CONFIG)),
+          )
+        }
+      } finally {
         if (!cancelled) setIsLoading(false)
-      })
+      }
+    })()
 
     return () => {
       cancelled = true