[Feature] Point marketing Decap at the shared OAuth service; keep Contact on marketing-edge #283

Goal

Point Platform Kit marketing Decap /admin at the shared org service cms-oauth-kit (https://auth.singletonsd.com) instead of ssd-pocpk-decap-oauth-dev-ae.

Keep the existing marketing-edge Function App for anonymous brochure HTTP (POST /contact, /health). Do not move Contact into the shared OAuth service.

Locked decisions (from singleton-sd/marketing#6)

• Shared repo: singleton-sd/cms-oauth-kit
• base_url: https://auth.singletonsd.com
• Shared ORIGINS already covers this site (*.singletonsd.com includes plattform-kit.poc.singletonsd.com). Do not maintain a second origin list here.

Why

apps/marketing-oauth currently mixes two unrelated jobs on one host:

1. Decap GitHub OAuth (/auth, /callback) — needed by every Decap marketing site.
2. Marketing Contact (/contact) — Platform Kit–specific, uses @poc-plattform-kit/email and PK Key Vault / App Config.

InkAds marketing already sets base_url to this PoC Function. After the shared service exists, PK should consume it like any other site and stop being an OAuth provider.

Scope

In scope:

• Update apps/marketing/public/admin/config.yml:
  • base_url: https://auth.singletonsd.com
  • Keep auth_endpoint: auth and backend.repo: singleton-sd/poc-plattform-kit.
• Remove OAuth-only code and wiring from this repo without deleting the Contact Function:
  • Delete src/functions/auth.ts, src/functions/callback.ts, github-oauth.ts (+ specs) from apps/marketing-oauth once unused.
  • Keep /contact, /health, email vendor zip deploy, rate limit.
  • Strip OAuth app settings from infra/decap-oauth.bicep (OAUTH_*, REDIRECT_URL, SCOPES, Decap ORIGINS if only used by OAuth). Rename the Bicep/workflow later if useful; not required in this PR if it risks a larger infra diff — a follow-up rename is OK if called out in the PR.
  • Stop requiring GitHub Variable DECAP_OAUTH_CLIENT_ID and KV secret github-decap-oauth-client-secret for this Function. Do not delete those names from PK KV until no PK resource reads them.
• Update docs that currently say this repo hosts the shared Decap OAuth proxy:
  • docs/marketing-astro-decap.md
  • docs/marketing-edge.md
  • AGENTS.md architecture bullet for marketing-edge (OAuth is no longer a reason this Function exists; Contact is).
  • SETUP.md / infra/README.md OAuth sections as needed.
• .github/workflows/deploy-decap-oauth.yml stays as marketing-edge / Contact deploy (path filters should no longer be described as “Decap OAuth”). Adjust path filters if OAuth-only files are gone.
• Verify /admin GitHub login on https://plattform-kit.poc.singletonsd.com/admin (custom domain, not the raw SWA default host).
• Verify Contact form still posts to {PUBLIC_MARKETING_API_BASE_URL}/contact on the PK Function (ssd-pocpk-decap-oauth-dev-ae unless a later issue renames it).

Out of scope:

• Creating cms-oauth-kit or deploying to rg-ssd-global.
• Renaming ssd-pocpk-decap-oauth-dev-ae / apps/marketing-oauth (nice follow-up; do not block cutover on a rename).
• Moving Contact to Nest or to PostKit.

Acceptance criteria

• Decap /admin on https://plattform-kit.poc.singletonsd.com/admin completes GitHub login via https://auth.singletonsd.com (popup handshake succeeds).
• config.yml base_url is https://auth.singletonsd.com (not https://ssd-pocpk-decap-oauth-dev-ae.azurewebsites.net).
• POST /contact on ssd-pocpk-decap-oauth-dev-ae still works; PUBLIC_MARKETING_API_BASE_URL still targets this PK Function, not auth.singletonsd.com.
• This repo no longer deploys /auth or /callback.
• Docs no longer describe PK as the org Decap OAuth provider; they link singleton-sd/cms-oauth-kit AGENTS.md.
• pnpm --filter @poc-plattform-kit/marketing-oauth test is green (Contact + remaining unit tests).
• KV github-decap-oauth-client-secret is not required for PK Function deploy.

Constraints

• Marketing public HTTP stays on the PK Function App — see docs/marketing-edge.md. Do not attach Contact to Nest.
• Do not point PUBLIC_MARKETING_API_BASE_URL at https://auth.singletonsd.com.
• Do not open /admin for OAuth testing on *.azurestaticapps.net default hosts — those are not in shared ORIGINS. Use *.singletonsd.com.
• Secrets stay in Key Vault; never GitHub Secrets.
• CAF / cheapest SKUs unchanged for the remaining PK Function (still on pocpk-plan B1).

Dependencies

Depends on: singleton-sd/marketing#6

Do not start until https://auth.singletonsd.com/health returns 200.

Blocks: InkAds can cut over in parallel with this issue (both only need the shared service). No hard block between PK and InkAds.

Technical references

• Decap config: apps/marketing/public/admin/config.yml
• Function: apps/marketing-oauth/ (auth.ts, callback.ts, contact.ts)
• Bicep: infra/decap-oauth.bicep
• Deploy: .github/workflows/deploy-decap-oauth.yml, scripts/deploy-decap-oauth.ps1
• Docs: docs/marketing-astro-decap.md, docs/marketing-edge.md
• Shared service tracker: [Feature] Bootstrap singleton-sd/cms-oauth-kit in rg-ssd-global (auth.singletonsd.com) marketing#6
• Target RG for the shared Function (not this Function): https://portal.azure.com/#@singletonsd.com.au/resource/subscriptions/01c0bb8b-3770-4765-979a-cb13ae7e3dd2/resourceGroups/rg-ssd-global/overview

Agent-ready checklist

• Goal/problem statement is clear
• Scope is sufficient to start work without further business clarification
• Acceptance criteria are explicit
• Relevant constraints are stated
• No unresolved blocking dependency (Depends on) — blocked on [Feature] Bootstrap singleton-sd/cms-oauth-kit in rg-ssd-global (auth.singletonsd.com) marketing#6