Add authentication architecture draft

[ootakazuhiko]

Summary

• document the proposed Google Workspace based SSO approach
• outline passkey/MFA handling, session strategy, and data model stubs
• describe optional Google Group sync via read-only Admin SDK access

Testing

• not applicable

[Copilot]

Pull Request Overview

This PR introduces a new authentication architecture document (in Japanese) for an ERP4 system. The document outlines a federated authentication design using Google Workspace as the identity provider with OpenID Connect, eliminating local password storage and enabling passwordless authentication via Passkey.

Key Changes:

• Defines authentication flow using Google Workspace OIDC with Passkey/MFA support
• Specifies RBAC model with Google Groups integration via Directory API sync
• Establishes session management, audit logging, and security policies

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Missing space in 'SameSiteStrict' - should be 'SameSite Strict' or 'SameSite=Strict' for clarity.

Suggested change

	- **CSRF／XSS 対策**: SameSiteStrict Cookie／CSRF トークン併用。SPA の場合は BFF パターンを採用。
	- **CSRF／XSS 対策**: SameSite=Strict Cookie／CSRF トークン併用。SPA の場合は BFF パターンを採用。