docs: add Phase 4 TODO.md files to services and packages

- services/chat/xmpp-server: Prosody OIDC auth
- services/chat/irc-client-lounge: The Lounge HTTP auth
- services/chat/irc-services: Atheme NickServ provisioning
- services/chat/irc-client-obsidian: ObsidianIRC OAuth flow
- apps/bridge: API key provisioning
- packages/ui: Chat UI components + design tokens

Author: kzndotsh

apps/bridge/TODO.md

@@ -0,0 +1,8 @@
+# TODO
+
+- [ ] Add `ChatMessage`, `NickBadge`, `StatusIndicator` components
+- [ ] Add chat design tokens to `src/styles/design-tokens.css`:
+  - Nick colors (7-color palette for hash-based nick coloring)
+  - Message bubbles (`--atl-message-bg`, `--atl-message-self-bg`, `--atl-message-border-radius`)
+  - Status indicators (`--atl-status-online`, `--atl-status-away`, `--atl-status-offline`, `--atl-status-banned`)
+  - Protocol source badges (`--atl-source-irc`, `--atl-source-xmpp`, `--atl-source-discord`)

packages/ui/TODO.md

@@ -0,0 +1,5 @@
+# TODO
+
+- [ ] Implement `POST /api/auth/thelounge` endpoint in portal
+- [ ] Configure The Lounge HTTP auth backend to call portal endpoint
+- [ ] Test login flow: Lounge → portal validates → returns user identity

services/chat/irc-client-lounge/TODO.md

@@ -0,0 +1,5 @@
+# TODO
+
+- [ ] Register ObsidianIRC as OAuth2 client in portal (`client_id=obsidian`, `irc` scope)
+- [ ] Implement redirect flow: ObsidianIRC → portal auth → token with `irc_nick` claim
+- [ ] Pre-fill IRC connection dialog with `irc_nick` from token

services/chat/irc-client-obsidian/TODO.md

@@ -0,0 +1,5 @@
+# TODO
+
+- [ ] Implement portal → Atheme NickServ provisioning webhook
+- [ ] On `ircAccount` creation in portal, call Atheme JSON-RPC to register NickServ account
+- [ ] Users should not need to manually `/msg NickServ REGISTER`

services/chat/irc-services/TODO.md

@@ -0,0 +1,5 @@
+# TODO
+
+- [ ] Configure `mod_auth_oauth2` against portal OIDC endpoint (`authentication = "oauth2"`)
+- [ ] Set `oauth2_provider`, `oauth2_client_id`, `oauth2_client_secret` in prosody.cfg.lua
+- [ ] Test XMPP login with portal credentials (xmpp scope returns `xmpp_username`)