feat: add OIDC login with account linking

Add OpenID Connect as an alternative login method. Users can sign in
via an external identity provider (e.g., Authentik, Keycloak, Google).

- OIDC settings configured in admin UI (discovery URL, client ID/secret,
  redirect URI, button label, enable/disable toggle)
- PKCE-based authorization code flow with state and nonce validation
- Admin can manually link any user's OIDC identity (sub/issuer fields)
- Self-service linking: logged-in users can link/unlink their own account
- SSO button conditionally shown on login page when OIDC is enabled
- Username in header now clickable to open profile for all users
- Callback errors/success communicated via URL hash fragments

package.json

@@ -15,6 +15,7 @@
     "express-session": "^1.19.0",
     "multer": "^2.1.1",
     "nodemailer": "^8.0.4",
+    "openid-client": "^5.7.1",
     "pdfkit": "^0.15.0"
   },
   "devDependencies": {