Add migration to add auth_user_id column to users table

- Introduced a new column 'auth_user_id' of type UUID to the 'users' table.
- Updated existing user data to set 'auth_user_id' to null for UserId 1.
- Created a unique index on 'auth_user_id' to enforce uniqueness.
- Implemented rollback functionality to remove the column and index if needed.

Backend/ERPCore/Program.cs

@@ -8,6 +8,7 @@ using ERPCore.Services;
 using ERPCore.Services.Interfaces;
 using ERPCore.Services.Stock;
 using ERPCore.System.Errors;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.OpenApi;
 using Serilog;
@@ -31,12 +32,14 @@ builder.Services.AddDbContext<ErpDbContext>(o =>
 builder.Services.AddProblemDetails();
 builder.Services.AddExceptionHandler<DomainExceptionHandler>();
 
-// JWT bearer auth (RBAC deferred; identity used only for the audit stamp)
+// Auth: validate external AuthHex RS256 tokens + ERP door policy (docs/10 A.4)
 builder.Services.AddErpJwtAuth(builder.Configuration);
 
-// Current-user (audit actor) derived from token `sub`
+// Current-user (audit actor). AuthHex has no sub/nameid → a claims transformation
+// JIT-provisions a local shadow user and injects the local `long` id as `nameid`.
 builder.Services.AddHttpContextAccessor();
 builder.Services.AddScoped<ICurrentUser, CurrentUser>();
+builder.Services.AddScoped<IClaimsTransformation, ShadowUserClaimsTransformation>();
 
 // Unit of work + generic repository base
 builder.Services.AddScoped<IUnitOfWork, UnitOfWork>();