feat(orgchart): Introduce standalone orgchart RP and shared link public API

This commit includes:
- Added SharedLink data model and Keto-bypassed public API for orgchart view
- Configured 'orgfront' as a new OAuth2 client in hydra
- Applied MH Dashboard premium beige theme to OrgChart
- Implemented user lookup fallback to company code

backend/internal/repository/shared_link_repository.go

@@ -0,0 +1,51 @@
+package repository
+
+import (
+	"baron-sso-backend/internal/domain"
+	"context"
+
+	"gorm.io/gorm"
+)
+
+type SharedLinkRepository interface {
+	Create(ctx context.Context, link *domain.SharedLink) error
+	FindByToken(ctx context.Context, token string) (*domain.SharedLink, error)
+	FindByTenantID(ctx context.Context, tenantID string) ([]domain.SharedLink, error)
+	Delete(ctx context.Context, id string) error
+	Update(ctx context.Context, link *domain.SharedLink) error
+}
+
+type sharedLinkRepository struct {
+	db *gorm.DB
+}
+
+func NewSharedLinkRepository(db *gorm.DB) SharedLinkRepository {
+	return &sharedLinkRepository{db: db}
+}
+
+func (r *sharedLinkRepository) Create(ctx context.Context, link *domain.SharedLink) error {
+	return r.db.WithContext(ctx).Create(link).Error
+}
+
+func (r *sharedLinkRepository) FindByToken(ctx context.Context, token string) (*domain.SharedLink, error) {
+	var link domain.SharedLink
+	err := r.db.WithContext(ctx).Where("token = ? AND is_active = ?", token, true).First(&link).Error
+	if err != nil {
+		return nil, err
+	}
+	return &link, nil
+}
+
+func (r *sharedLinkRepository) FindByTenantID(ctx context.Context, tenantID string) ([]domain.SharedLink, error) {
+	var links []domain.SharedLink
+	err := r.db.WithContext(ctx).Where("tenant_id = ?", tenantID).Find(&links).Error
+	return links, err
+}
+
+func (r *sharedLinkRepository) Delete(ctx context.Context, id string) error {
+	return r.db.WithContext(ctx).Delete(&domain.SharedLink{}, "id = ?", id).Error
+}
+
+func (r *sharedLinkRepository) Update(ctx context.Context, link *domain.SharedLink) error {
+	return r.db.WithContext(ctx).Save(link).Error
+}

backend/internal/repository/user_repository.go

@@ -20,6 +20,8 @@ type UserRepository interface {
 	CountByTenant(ctx context.Context, tenantID string) (int64, error)
 	CountByTenantIDs(ctx context.Context, tenantIDs []string) (map[string]int64, error)
 	CountByCompanyCodes(ctx context.Context, codes []string) (map[string]int64, error)
+	FindByTenantIDs(ctx context.Context, tenantIDs []string) ([]domain.User, error)
+	FindByCompanyCodes(ctx context.Context, codes []string) ([]domain.User, error)
 	Delete(ctx context.Context, id string) error
 
 	// Multiple identifiers support
@@ -261,3 +263,15 @@ func (r *userRepository) FindTenantIDByLoginID(ctx context.Context, loginID stri
 	}
 	return record.TenantID, nil
 }
+
+func (r *userRepository) FindByTenantIDs(ctx context.Context, tenantIDs []string) ([]domain.User, error) {
+	var users []domain.User
+	err := r.db.WithContext(ctx).Where("tenant_id IN ?", tenantIDs).Find(&users).Error
+	return users, err
+}
+
+func (r *userRepository) FindByCompanyCodes(ctx context.Context, codes []string) ([]domain.User, error) {
+	var users []domain.User
+	err := r.db.WithContext(ctx).Where("company_code IN ?", codes).Find(&users).Error
+	return users, err
+}