Django SSO (OIDC) + migrate Firebase Auth users into Django (2 apps)

ABOUT THE PROJECT We run two Django applications and are unifying their authentication. - App A: Django, classic Django authentication, an OAuth2 package already installed [confirm package, e.g. django-oauth-toolkit]. - App B: Django, authentication via Firebase Auth (email + password, and Google/Facebook sign-in). Uses WebSockets for realtime features. - Both have web frontends. GOAL App A becomes the single identity provider for both apps. Firebase Auth is retired after App B's users are migrated into App A. SCOPE AND MILESTONES (fixed price, paid per milestone) 1. Design (short written doc, reviewed with us before any build): SSO protocol choice (we expect OIDC with App A as the provider), token format and lifetimes, user mapping strategy, migration and rollback plan. 2. SSO: users log into App B via App A. During transition App B must accept both existing Firebase sessions and App A tokens, with no forced logouts. 3. App A calling App B's APIs: App B validates tokens issued by App A (audience/scope checks), including authentication of WebSocket connections. 4. User migration: move App B's Firebase users into App A. - Email/password users keep their passwords (import Firebase password hashes and verify them in Django, no mass password reset). - Google/Apple users keep working and are linked to their accounts. - Users who exist in both apps are merged safely (verified email matching, conflict handling). - App B's data that references Firebase UIDs is remapped. - Dry run on staging with a copy of production-like data, plus a reconciliation report. 5. Cutover: switch App B fully to App A auth, disable Firebase Auth, with a tested rollback plan and short handover documentation. DEFINITION OF DONE - One login for both apps, existing users unaffected. - Automated tests for the auth flows, token validation and the migration script. - Code delivered via pull requests to our repos and reviewed by our team. - Runbook for the cutover and rollback. REQUIREMENTS - Proven production experience with Django authentication and OAuth2/OIDC (as a provider, not only as a client). - Hands-on experience migrating users out of Firebase Auth, including password hash import. - Experience with Django Channels / WebSocket authentication. - Security-minded: token validation, key rotation, least-privilege access. - Communication in English. Please answer the screening questions, and include a short outline of how you would approach milestone 4 (user migration). Don't send proposal without budget(fixed)