Extract config structs into pkg/probodconfig

probod-bootstrap only needs the config struct definitions for
YAML marshaling but transitively pulled in ~40 heavy runtime
dependencies via pkg/probod. Move all config types and their
methods to a new pkg/probodconfig package and re-export them
from pkg/probod via type aliases for backward compatibility.

Signed-off-by: Émile Ré <emile@getprobo.com>

pkg/probodconfig/auth_config.go

@@ -0,0 +1,98 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probodconfig
+
+import (
+	"encoding/base64"
+	"fmt"
+)
+
+type AuthConfig struct {
+	Cookie                              CookieConfig       `json:"cookie"`
+	Password                            PasswordConfig     `json:"password"`
+	DisableSignup                       bool               `json:"disable-signup"`
+	InvitationConfirmationTokenValidity int                `json:"invitation-confirmation-token-validity"`
+	PasswordResetTokenValidity          int                `json:"password-reset-token-validity"`
+	MagicLinkTokenValidity              int                `json:"magic-link-token-validity"`
+	SAML                                SAMLConfig         `json:"saml"`
+	Google                              OIDCProviderConfig `json:"google"`
+	Microsoft                           OIDCProviderConfig `json:"microsoft"`
+	OAuth2Server                        OAuth2ServerConfig `json:"oauth2-server"`
+}
+
+type OAuth2ServerConfig struct {
+	SigningKeys               []OAuth2SigningKeyConfig `json:"signing-keys"`
+	AccessTokenDuration       int                      `json:"access-token-duration"`
+	RefreshTokenDuration      int                      `json:"refresh-token-duration"`
+	AuthorizationCodeDuration int                      `json:"authorization-code-duration"`
+	DeviceCodeDuration        int                      `json:"device-code-duration"`
+}
+
+type OAuth2SigningKeyConfig struct {
+	PrivateKey string `json:"private-key"`
+	KID        string `json:"kid"`
+	Active     bool   `json:"active"`
+}
+
+type CookieConfig struct {
+	Domain   string `json:"domain"`
+	Secret   string `json:"secret"`
+	Duration int    `json:"duration"`
+	Name     string `json:"name"`
+	Secure   bool   `json:"secure"`
+}
+
+type PasswordConfig struct {
+	Iterations int    `json:"iterations"`
+	Pepper     string `json:"pepper"`
+}
+
+func (c AuthConfig) GetPepperBytes() ([]byte, error) {
+	if c.Password.Pepper == "" {
+		return nil, fmt.Errorf("pepper cannot be empty")
+	}
+
+	if decoded, err := base64.StdEncoding.DecodeString(c.Password.Pepper); err == nil {
+		if len(decoded) < 32 {
+			return nil, fmt.Errorf("decoded pepper must be at least 32 bytes long")
+		}
+		return decoded, nil
+	}
+
+	if len(c.Password.Pepper) < 32 {
+		return nil, fmt.Errorf("pepper must be at least 32 bytes long")
+	}
+
+	return []byte(c.Password.Pepper), nil
+}
+
+func (c AuthConfig) GetCookieSecretBytes() ([]byte, error) {
+	if c.Cookie.Secret == "" {
+		return nil, fmt.Errorf("cookie secret cannot be empty")
+	}
+
+	if decoded, err := base64.StdEncoding.DecodeString(c.Cookie.Secret); err == nil {
+		if len(decoded) < 32 {
+			return nil, fmt.Errorf("decoded cookie secret must be at least 32 bytes long")
+		}
+		return decoded, nil
+	}
+
+	if len(c.Cookie.Secret) < 32 {
+		return nil, fmt.Errorf("cookie secret must be at least 32 bytes long")
+	}
+
+	return []byte(c.Cookie.Secret), nil
+}