feat(auth): add OIDC SSO login

Adds an OpenID Connect relying-party login path (PKCE authorization-code
flow) against a single env-configured identity provider — additive to
password/passkey login by default, with an operator opt-in (OIDC_ONLY,
enforced server-side on every auth route) to disable them entirely.
First-time sign-in auto-provisions or links an account by verified email.

Closes an open redirect in the post-login `next` parameter (both the new
OIDC path and the pre-existing password/passkey flow shared the same
backslash-normalization bypass) by resolving the target through a real
URL parse and comparing origins instead of a prefix check.

src/proxy.ts

@@ -15,6 +15,14 @@ const PUBLIC_PATHS = [
   "/api/auth/registration-status",
   "/api/auth/passkey/login-options",
   "/api/auth/passkey/login-verify",
+  // OIDC SSO login. `login` starts the redirect to the IdP, `callback`
+  // completes it and mints the session — both must be reachable with no
+  // existing session, since they authenticate the user in the first
+  // place. `status` is the public flag the login page reads to decide
+  // whether to render the SSO button.
+  "/api/auth/oidc/login",
+  "/api/auth/oidc/callback",
+  "/api/auth/oidc/status",
   "/api/health",
   "/api/version",
   "/api/notifications/vapid",