Feat v0.6.6 final hardening

Final pass before public release — security, correctness, developer experience.

- ValidateManifest() gate: centralized manifest validation (12 unit tests)
- Extension dependency auto-activation from bundled packages
- OIDC nonce validation: ID token nonce checked against stored state
- Schema migration stub replaced with log-only additive policy
- OptionalAuth middleware for anonymous workflow visitor routes
- Package signing schema reservation (signature field + env var)
- PublishAsync event bus counter fix
- Health UI tooltips explaining published vs delivered gap
- ICD/SDK runner updated for v0.6.x endpoints (metrics, cluster, backups, OpenAPI)
- Version bump, ROADMAP, CHANGELOG

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/auth/oidc.go

@@ -246,6 +246,7 @@ type oidcClaims struct {
 	Email             string      `json:"email"`
 	PreferredUsername  string      `json:"preferred_username"`
 	Name              string      `json:"name"`
+	Nonce             string      `json:"nonce"`
 	Groups            []string    `json:"groups"`
 	RealmAccess       realmAccess `json:"realm_access"`
 	ResourceAccess    interface{} `json:"resource_access"`
@@ -304,6 +305,23 @@ func (p *OIDCProvider) validateToken(tokenString string) (*oidcClaims, error) {
 	return claims, nil
 }
 
+// ValidateIDTokenNonce validates that the ID token's nonce claim matches the
+// stored nonce from the authorization request. This prevents token replay and
+// substitution attacks in the authorization code flow.
+func (p *OIDCProvider) ValidateIDTokenNonce(tokenString, expectedNonce string) error {
+	if expectedNonce == "" {
+		return nil // no nonce to validate (e.g. direct token flow)
+	}
+	claims, err := p.validateToken(tokenString)
+	if err != nil {
+		return fmt.Errorf("token validation failed: %w", err)
+	}
+	if claims.Nonce != expectedNonce {
+		return fmt.Errorf("nonce mismatch: expected %q, got %q", expectedNonce, claims.Nonce)
+	}
+	return nil
+}
+
 // isIdPAdmin checks whether the OIDC claims include the configured admin role.
 func (p *OIDCProvider) isIdPAdmin(claims *oidcClaims) bool {
 	for _, role := range claims.RealmAccess.Roles {