ath fix

Backend/ERPCore/Program.cs

@@ -1,10 +1,12 @@
 using System.Text.Json.Serialization;
 using ERPCore.Infra.Auth;
+using ERPCore.Infra.Auth.AuthHex;
 using ERPCore.Infra.Persistence;
 using ERPCore.Infra.UoW;
 using ERPCore.Repositories;
 using ERPCore.Repositories.Interfaces;
 using ERPCore.Services;
+using ERPCore.Services.Auth;
 using ERPCore.Services.Interfaces;
 using ERPCore.Services.Stock;
 using ERPCore.System.Errors;
@@ -35,6 +37,17 @@ builder.Services.AddExceptionHandler<DomainExceptionHandler>();
 // Auth: validate external AuthHex RS256 tokens + ERP door policy (docs/10 A.4)
 builder.Services.AddErpJwtAuth(builder.Configuration);
 
+// AuthController proxy → AuthHex (docs/11 §2.0)
+builder.Services.AddHttpClient<IAuthHexClient, AuthHexClient>(c =>
+{
+    var baseUrl = builder.Configuration["AuthHex:BaseUrl"]
+        ?? throw new InvalidOperationException("AuthHex:BaseUrl is not configured.");
+    c.BaseAddress = new Uri(baseUrl);
+});
+builder.Services.AddScoped<IAuthUserService, AuthUserService>();
+builder.Services.AddScoped<IAuthRecoveryService, AuthRecoveryService>();
+builder.Services.AddScoped<IAuthAltService, AuthAltService>();
+
 // Current-user (audit actor). AuthHex has no sub/nameid → a claims transformation
 // JIT-provisions a local shadow user and injects the local `int` id as `nameid`.
 builder.Services.AddHttpContextAccessor();