FIX Use Microsoft Graph for GUI authentication and group authorization

[behnam-o]

The GUI previously requested a custom API token that the backend could validate locally, but that token could not be used to query Microsoft Graph for group membership.

This change:

• Requests a delegated Microsoft Graph token with User.Read
• Authenticates users through Graph /me
• Resolves authorization groups through /me/getMemberObjects
• Requires configured allowed groups when authentication is enabled
• Adds a short-lived, bounded cache to reduce Graph traffic
• Updates deployment configuration, documentation, and tests

Graph tokens are treated as opaque by the backend. Authentication and group authorization failures are handled through a typed internal exception and converted to HTTP responses at the middleware boundary.

• it also fixes the auth flow on the frontend and prevents duplicate MSAL initialization and redirect handling