Add Mode1 auth testing environment with token comparison verification

- Created Mode1 as self-contained test environment
- Added auth-module copy with self-contained configuration
- Implemented backend server with Graph token and PocketBase validation endpoints
- Added frontend test dashboard with token comparison functionality
- Fixed TypeScript compatibility issues (replaced import.meta.dir with __dirname)
- Implemented actual PB token validation in comparison endpoint (no placeholders)
- All endpoints tested and working with real tokens

Mode1/README.md

@@ -0,0 +1,99 @@
+# Mode1 - Auth Module Test Suite
+
+Self-contained test environment for the auth-module. This directory includes its own copy of auth-module and all dependencies.
+
+## Structure
+
+```
+Mode1/
+├── auth-module/          # Local copy of auth-module (not linked to root)
+├── backend/              # Backend server with auth endpoints
+│   └── server.ts        # Hono app with Graph token and PB validation APIs
+├── frontend/            # Frontend test interface
+│   └── index.html       # Interactive test dashboard
+├── logs/                # Application logs
+├── package.json         # Dependencies (auth module + Hono + PocketBase)
+└── bun.lock             # Locked dependencies
+```
+
+## Features Tested
+
+✓ **Frontend Auth (PocketBaseAuth)**
+  - OAuth2 login initialization
+  - Auth state retrieval
+  - Token refresh
+  - Logout
+
+✓ **Backend Auth (GraphTokenManager)**
+  - Microsoft Graph token acquisition
+  - Token caching (with 60s expiration buffer)
+  - Cache validity checking
+  - Cache refresh
+
+✓ **PocketBase Validation (PocketBaseValidator)**
+  - User token validation
+  - User record retrieval
+
+## Running Mode1
+
+### Via Orchestrator (recommended)
+
+```bash
+# Switch to Mode1
+curl -X POST http://localhost:3006/switch/Mode1
+
+# Check status
+curl http://localhost:3006/status
+```
+
+### Direct
+
+```bash
+# Install dependencies (already done)
+bun install
+
+# Start server
+bun run backend/server.ts
+
+# Access dashboard
+open http://localhost:3005
+```
+
+## API Endpoints
+
+### Configuration
+- `GET /api/auth/config` - Get frontend configuration
+
+### Graph Token Management
+- `GET /api/auth/graph/token` - Get current Graph token (with expiration)
+- `POST /api/auth/refresh-graph` - Force refresh Graph token
+
+### PocketBase Validation
+- `POST /api/auth/validate-pb-token` - Validate a PocketBase token
+
+### Health
+- `GET /health` - Health check
+
+## Environment Variables
+
+Uses `/home/admin/secrets/.env` via auth-module:
+- `CLIENT_ID` - Microsoft application ID
+- `TENANT_ID` - Azure tenant ID
+- `CLIENT_SECRET` - Microsoft client secret
+- `PB_URL` - PocketBase frontend URL
+- `PB_DB` - PocketBase backend URL
+
+## Dependencies
+
+All dependencies are installed locally in `node_modules/`:
+- `hono` - Web framework
+- `pocketbase` - PocketBase client
+- `@azure/msal-node` - Microsoft authentication
+- `dotenv` - Environment variable loading
+
+## Notes
+
+- This Mode1 is **completely self-contained** with its own auth-module copy
+- No dependencies on root auth-module
+- Safe to modify and test independently
+- All secrets come from `/home/admin/secrets/.env`