Single sign-on across modules (OIDC)

Nucleo modules now authenticate against the shared Nucleo identity provider via OpenID Connect: one login, account selection, global logout and per-module roles carried in the token.

The unified shell went live on its own infrastructure at app.nucleoplatform.com, with the PIM as the first module fully on the single sign-on.