Add generic OIDC authentication for self-hosted deployments

[drybalka-s]

Problem

Self-hosted Multica deployments cannot use an organization-managed OpenID Connect provider such as Authentik or GitLab. Operators are limited to email verification codes or the dedicated Google OAuth integration, which prevents centralized access policy and group-based admission.

Proposed behavior

• Add one discovery-capable generic OIDC provider alongside the existing Google flow.
• Validate authorization responses with state, nonce, PKCE, issuer, audience, signature, subject, and verified email checks.
• Link accounts by the stable (issuer, subject) identity so provider-side email changes do not create duplicate users.
• Optionally restrict access with a configurable group claim and allowlist.
• Support web, desktop, CLI-compatible callback state, and iOS browser handoff.
• Expose only the provider display name through public runtime config.
• Document environment variables and wire them through Docker Compose and Helm.

Acceptance criteria

• Authentik and GitLab can be configured through standard OIDC discovery.
• Existing email-code and Google sign-in continue to work unchanged.
• OIDC is hidden when configuration is incomplete.
• Malformed or replayed flows fail closed.
• Deployment documentation and automated tests cover configuration, callback routing, group claims, and mobile handoff.

[drybalka-s]

ping