Feat v0.6.6 final hardening

Final pass before public release — security, correctness, developer experience.

- ValidateManifest() gate: centralized manifest validation (12 unit tests)
- Extension dependency auto-activation from bundled packages
- OIDC nonce validation: ID token nonce checked against stored state
- Schema migration stub replaced with log-only additive policy
- OptionalAuth middleware for anonymous workflow visitor routes
- Package signing schema reservation (signature field + env var)
- PublishAsync event bus counter fix
- Health UI tooltips explaining published vs delivered gap
- ICD/SDK runner updated for v0.6.x endpoints (metrics, cluster, backups, OpenAPI)
- Version bump, ROADMAP, CHANGELOG

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/auth.go

@@ -218,8 +218,8 @@ func (h *AuthHandler) OIDCCallback(c *gin.Context) {
 		return
 	}
 
-	// Verify state (nonce + redirectTo retrieved but not yet validated — TODO)
-	_, _, err := h.stores.GlobalConfig.ConsumeOIDCState(c.Request.Context(), state)
+	// Verify state and retrieve nonce for ID token validation
+	storedNonce, _, err := h.stores.GlobalConfig.ConsumeOIDCState(c.Request.Context(), state)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid or expired state"})
 		return
@@ -246,6 +246,15 @@ func (h *AuthHandler) OIDCCallback(c *gin.Context) {
 		return
 	}
 
+	// Validate nonce in the ID token to prevent token replay/substitution
+	if tokenResp.IDToken != "" && storedNonce != "" {
+		if err := oidcProv.ValidateIDTokenNonce(tokenResp.IDToken, storedNonce); err != nil {
+			log.Printf("[auth/oidc] nonce validation failed: %v", err)
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "nonce validation failed"})
+			return
+		}
+	}
+
 	// Use the ID token (or access token) to authenticate via the provider
 	// Temporarily set the Authorization header so Authenticate() can read it
 	tokenToValidate := tokenResp.IDToken