RFE: Backend identity-store migration and interoperability tooling #6000

The backend already implements OAuth2/OIDC, an authorization server, passkeys, TOTP, remember-me, and pluggable user/credential repositories and password encoders. The remaining gap is a documented and tested migration path for existing identity stores, signing keys, password encodings, and WebAuthn credentials. Requiring every application to rediscover these boundaries makes migration unnecessarily risky.

Requested capability

• Provide migration examples and compatibility checks for externally managed user/role tables, federated identities, signing keys, passkeys, and password hashes.
• Document custom password-encoding identifiers and configurable legacy PBKDF2 parameters using the existing encoder extension points.
• Define which sessions, remember-me tokens, MFA secrets, and authorization state can be preserved and which require explicit invalidation or re-enrollment.
• Add protocol and credential fixtures that verify stable issuer, subject, audience, roles/scopes, and credential encodings.

Acceptance criteria

• An example migrates an existing identity fixture without resetting supported passwords or changing user subjects.
• Unsupported credentials and state produce an explicit migration report rather than silent acceptance or data loss.
• Passkey and signing-key fixtures preserve identifiers and validate cryptographic compatibility.
• Documentation distinguishes existing security features from migration helpers and states any required sign-in/re-enrollment steps.

Current implementation

• docs/developer-guide/Backend-Security.asciidoc
• vm/backend/src/com/codename1/backend/security/crypto/DelegatingPasswordEncoder.java
• vm/backend/src/com/codename1/backend/security/webauthn

Validate behavior on the JVM and locally on the packaged ParparVM backend where applicable. This request does not call for native-image or GraalVM CI jobs.