feat(templates): add final six auth starters

[kraus-it]

Slice 4 of 6 — complete the framework catalog

Stacked on #17. This PR intentionally remains open.

Adds

• SvelteKit, Nuxt, Astro, React Router, Django, and FastAPI starters
• Authorization Code + PKCE S256 and validated ID-token flows
• UserInfo subject binding, one-time callbacks, opaque server-side sessions, and RP-initiated logout
• explicit HTTPS/loopback validation and bounded transient in-memory stores
• shared authentication contract and manifest/package validation

Verification

• SvelteKit: check + production build
• Nuxt: typecheck + production build
• Astro: check + production build
• React Router: typecheck + production build
• Django: system check + 3 tests
• FastAPI: compileall + 3 tests
• Distribution: 17 tests + catalog validation (20 ready, 0 planned)

The six generated satellite repositories and fresh-clone verification will be added as follow-up evidence on this PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: af8b7d137b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kraus-it]

Slice 4 remote verification complete: all six public template repositories match source commit 30f4a6b with zero metadata or managed-file drift. Fresh public clones passed under the declared runtimes: Node 24.11 (SvelteKit, Nuxt, Astro, React Router) and Python 3.13 (Django, FastAPI). @claude please review this stacked PR, especially the OIDC transaction/session boundaries and the distribution automation.

[kraus-it]

@claude Please review the current head of this PR. Focus on correctness, security, distribution/sync behavior, reproducibility, and tests. Report only actionable findings; if clean, state that explicitly.

[kraus-it]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[kraus-it]

Review follow-up complete on current head 6f1b874.\n\nAddressed both open Codex threads:\n- React Router loads the CLI-written .env through pinned dotenv before runtime configuration reads.\n- Astro reads Tuurio settings through astro:env/server getSecret instead of raw process.env.\n\nThe earlier local Claude review findings are also included in ecd7e1a. Verification on Node 24.11: React Router clean install, typecheck, production build, and dotenv smoke test; Astro clean install, astro check, and server build; 17/17 Slice 4 distribution tests.\n\nAll review threads are resolved. The PR remains open as requested.