Release v3.3.0

[cschetan77]

Added

• feat: Add CTE impersonation via Session Transfer Token #850 (cschetan77)

---

CTE Impersonation via Session Transfer Token

Adds two new methods to req.oidc that implement the initiator role of the session transfer flow:

• requestSessionTransferToken(options) — mints a short-lived, single-use Session Transfer Token via Custom Token Exchange. Automatically sources the actor_token from the session id_token (refreshing if expired) and builds the urn:{domain}:session_transfer audience from the configured issuer. The STT is never written to the session.
• buildSessionTransferRedirect(targetLoginUrl, result) — pure URL builder that appends the STT as a query parameter to the target app's login URL.

See EXAMPLES.md for the full integration guide.