feat: implement full bff logic

config/packages/framework.yaml

@@ -0,0 +1,19 @@
+framework:
+    secret: '%env(APP_SECRET)%'
+    http_method_override: false
+    handle_all_throwables: true
+
+    # Used only for the short-lived PKCE/state leg in AuthController
+    # (/auth/login -> /auth/callback). App sessions are the separate
+    # Redis-backed, sid-keyed store in App\Session\BffSessionStore.
+    session:
+        cookie_secure: true
+        cookie_httponly: true
+        cookie_samesite: 'lax'
+
+    http_client: ~
+
+    # Filesystem cache is sufficient here — used only to cache Keycloak's
+    # JWKS in IdTokenDecoder, not for session state.
+    cache:
+        app: cache.adapter.filesystem