feat(auth): add authenticate callback for fallback logic

* Implement SetAuthenticateCallback in authenticators
* Update Authenticate methods to use callback on failure

pkg/security/chain.go

@@ -9,7 +9,8 @@ import (
 // ChainAuthenticator tries each authenticator in order, returning the first success.
 // Login and Logout are delegated to the primary authenticator.
 type ChainAuthenticator struct {
-	authenticators []Authenticator
+	authenticators       []Authenticator
+	authenticateCallback func(r *http.Request) (*UserContext, error)
 }
 
 // NewChainAuthenticator creates a ChainAuthenticator from the given authenticators.
@@ -29,13 +30,28 @@ func (c *ChainAuthenticator) Authenticate(r *http.Request) (*UserContext, error)
 			lastErr = err
 		}
 	}
+	if c.authenticateCallback != nil {
+		return c.authenticateCallback(r)
+	}
 	return nil, fmt.Errorf("all authenticators failed; last error: %w", lastErr)
 }
 
+func (c *ChainAuthenticator) SetAuthenticateCallback(fn func(r *http.Request) (*UserContext, error)) {
+	c.authenticateCallback = fn
+}
+
 func (c *ChainAuthenticator) Login(ctx context.Context, req LoginRequest) (*LoginResponse, error) {
 	return c.authenticators[0].Login(ctx, req)
 }
 
+func (c *ChainAuthenticator) LoginWithCookie(ctx context.Context, req LoginRequest, w http.ResponseWriter) (*LoginResponse, error) {
+	return c.authenticators[0].LoginWithCookie(ctx, req, w)
+}
+
 func (c *ChainAuthenticator) Logout(ctx context.Context, req LogoutRequest) error {
 	return c.authenticators[0].Logout(ctx, req)
 }
+
+func (c *ChainAuthenticator) LogoutWithCookie(ctx context.Context, req LogoutRequest, w http.ResponseWriter) error {
+	return c.authenticators[0].LogoutWithCookie(ctx, req, w)
+}