feat: add OIDC federation support (Entra ID / external IdP)

[varadhan06]

When using an external OIDC identity provider (e.g., Microsoft Entra ID) federated through Amazon Cognito, three issues occur:

1. No OAuth redirect — The Amplify config doesn't include loginWith.oauth, so users see the default Cognito username/password form instead of being redirected to the external IdP.

2. Random username displayed — For federated users, Cognito auto-generates a username like EntraID_SfmQzRfm.... The top navigation bar shows this instead of the user's actual name.

3. Real-time metrics broken — fetchUserAttributes() fails for OIDC-federated users. Since the IoT policy attach runs after it in the same try block, it gets silently skipped, breaking the MQTT connection for live test metrics.

Solution

4 files changed, 43 insertions, 6 deletions. All changes are backward-compatible.

source/infrastructure/lambda/aws-exports-handler/index.ts

• Include OAuthDomain and OAuthRedirectUrl in aws-exports.json when provided by CloudFormation

source/webui/src/main.tsx

• Conditionally add loginWith.oauth to the Amplify config when OAuthDomain is present

source/webui/src/components/navigation/TopNavigationBar.tsx

• Read name (or email) from idToken.payload via fetchAuthSession() and display it, falling back to user.username

source/webui/src/contexts/UserContext.tsx

• Move IoT policy attach before fetchUserAttributes()
• Wrap fetchUserAttributes() in its own try/catch so its failure doesn't block IoT setup

Backward Compatibility

When OAuthDomain is not configured (no external IdP), all behavior is identical to the current implementation:

• OAuth config is only added conditionally
• Display name falls back to user.username
• IoT policy attach still runs in the same order relative to other operations