Implement KCA: web reimplementation of XCA PKI workflows

- kaya backend with OIDC sessions, API tokens, Postgres/Tortoise models
- AES-256-GCM private key storage and full certificate/CSR/CRL domain logic
- Sycamore/WASM SPA for vaults, keys, requests, certificates, CRLs and templates
- imports/exports, XCA .xdb migration, Docker Compose stack and tests

server/tests/helpers/oidc.py

@@ -0,0 +1,35 @@
+"""Fake the OIDC-authenticated user during tests."""
+from __future__ import annotations
+
+import contextlib
+import unittest.mock as _mock
+from typing import Any, Iterator, Optional
+
+from kaya.oidc import OIDCUser
+
+from kca.app import oidc
+
+_PROVIDER = next(iter(oidc.providers))
+
+
+def make_user(sub: str, name: Optional[str] = None, **claims: Any) -> OIDCUser:
+    data: dict = {"sub": sub, "preferred_username": name or sub}
+    data.update(claims)
+    return OIDCUser(data)
+
+
+@contextlib.contextmanager
+def oidc_user(
+    sub: str,
+    name: Optional[str] = None,
+    **claims: Any,
+) -> Iterator[OIDCUser]:
+    data: dict = {"sub": sub, "preferred_username": name or sub}
+    data.update(claims)
+    user = OIDCUser(data)
+    patcher = _mock.patch.object(oidc, "get_users", return_value={_PROVIDER: user})
+    patcher.start()
+    try:
+        yield user
+    finally:
+        patcher.stop()