M21: add optional organisation identity

PROJECT_STATE.md

@@ -2503,3 +2503,20 @@ evidence yet."
   `/mnt/user/appdata/mobilityops/backups/postgres/mobilityops-20260810T111913Z.dump`.
 - Exact next action: none for the locked PoC. Routine operation, monitoring and any scope
   expansion require a separate approved milestone.
+
+## M21 — optional organisation identity alongside the public demo (2026-08-10)
+
+- Added standards-based OpenID Connect login while preserving both public demo roles and
+  the guided demo. Provider discovery, authorization-code exchange, state/nonce checks
+  and ID-token validation are delegated to Authlib's OIDC client.
+- External identities bind uniquely to issuer plus subject. A verified email is required;
+  deployments can enforce an email-domain allowlist and disable auto-provisioning. New
+  users receive the least-privileged rental role and every provision/link/login is
+  audited. Deactivated users remain blocked by the canonical user record.
+- Added the nullable external-identity migration `a81d0ce9f662`, configuration contract,
+  trilingual login action and runbook. OIDC secrets stay deployment-only.
+- Added Starlette's supported `httpx2` test transport, removing the prior suite-wide
+  deprecation warning rather than suppressing it.
+- Evidence: focused authentication **13 passed with zero warnings**; frontend production
+  build passed; ruff clean. Exact next action: implement structured request logging,
+  correlation, metrics, dashboards and alerts.