OIDC authentication support

[PortableProgrammer]

Proposal

Add OpenID Connect (OIDC) authentication support, allowing users to sign in via an external identity provider (Authentik, Keycloak, Auth0, Google, etc.) rather than (or in addition to) the local username+password flow.

Reference

Upstream oppiliappan/lurker PR #36 implements OIDC in a dedicated src/oidc.js. We can cherry-pick that file and its hooks into src/auth.js / src/routes/index.js, while skipping the PR's bundled PWA/media changes (we already have web manifest + srcset from v2.4.x and v2.5.0).

Scope

• OIDC config via env vars (OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_REDIRECT_URI, optionally OIDC_SCOPES)
• /auth/oidc/login route to initiate flow
• /auth/oidc/callback route to handle the redirect
• Create-or-find user record on first successful OIDC sign-in (link by sub claim or email — decide during PR review)
• JWT cookie issuance reuses the existing pattern from local login at src/routes/index.js:500-507
• Dashboard indicates which auth method was used for the current session
• OIDC users can set a local password as a fallback
• Login page shows OIDC button when configured, hides when not

Compatibility

Local password login continues to work when OIDC is configured. An admin can disable local login via another env var if desired (out of scope for v1).