Add tests and docs for initial ui-staff multi-portal auth architecture

[nnoce14]

Summary

Add the tests and architecture/docs updates needed to prove the new internal staff portal and multi-portal auth model.

Scope

• acceptance/integration coverage for initial ui-staff proving flow
• ADR documentation of @apps vs @ocom boundary split for frontend application development
• ADR documentation for multi-portal OIDC mock support
• ADR documentation for ui-staff enterprise app roles and RBAC (generally applicable)

Test scenarios to prove

• ui-community and ui-staff can coexist as separate portals
• each portal can use its intended OIDC configuration
• staff login reaches the correct placeholder section surfaces
• route access is enforced by the expected app roles
• unauthorized access is handled correctly

Acceptance criteria

• tests cover multi-portal auth flow and staff route authorization
• docs explain the new architecture clearly
• the intended package boundaries and auth model are discoverable for future contributors