Feat(Chore): Verify Flow, Invites, Suspend, Depart Cert Policy

feat: add password reset and email verification flow
feat: add org invite listing, cancellation, and invite link fallback
feat: add user suspend/unsuspend with audit logging
feat: add department certificate policy (expiry, extensions)
feat: enforce dept cert policy on SSH certificate signing
feat: wire up OIDC consent and token flow (replace mocks)
feat: rework CLI auth bridge to use frontend login flow
feat: add admin OAuth provider management (CRUD)
chore: refactor model import paths after module reorganisation
chore: clean up config, decorators, and dev tooling

.env.example

@@ -40,5 +40,9 @@ LOG_TO_STDOUT=True
 RATELIMIT_ENABLED=True
 RATELIMIT_STORAGE_URL=redis://localhost:6379/1
 
-# Testing
-TESTING=False
+# SSH CA
+# Path to CA private key file (alternative to SSH_CA_PRIVATE_KEY env var)
+SSH_CA_KEY_PATH=/path/to/ca-users
+# Or set the key content directly (takes priority over SSH_CA_KEY_PATH):
+# SSH_CA_PRIVATE_KEY=
+