Add OIDC authentication

[Alejandro-SB]

This should help moving towards closing #16

Summary

Adds optional OpenID Connect (OIDC) authentication support, enabling SSO login through providers like Authentik, Keycloak, Google, etc.

What was done

• Added openid-client v6.8.4 (handles discovery, PKCE, token exchange, and validation via jose + oauth4webapi).
• Added 6 new env vars (OIDC_ENABLED, OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_REDIRECT_URI, OIDC_SCOPES), documented in .env.example, env.server.ts, app.d.ts, and OpenWiki docs.
• Added oidc_id (unique, indexed) and oidc_provider columns to users. A database patch handles existing installations via ALTER TABLE.
• Added new server service oidcService.ts: OpenID discovery, PKCE S256 flow, state/nonce generation, authorization URL building, callback handling with token exchange and claims extraction.
• Added two new API routes:
  • GET /api/auth/oidc/login -> initiates flow, stores state/nonce/code_verifier in an httpOnly cookie, redirects to the OIDC provider.
  • GET /api/auth/oidc/callback -> validates state/nonce, exchanges the auth code for tokens, finds or creates a local user, sets session cookie.
• Added oidcEnabled state and oidcLogin method to Auth store
• Modified login UI: Conditionally rendered "or" divider + "Login with SSO" button when OIDC is enabled.
• User provisioning: Auto-creates users on first SSO login, deriving username from preferred_username → email → oidc_<sub_prefix>.
• Reuses existing session system: OIDC-authenticated users get the same session cookie as password-based users.

What's missing

• At the moment, when you log in with SSO, it will try to create a user with the preferred_username coming from claims if it doesn't clash with any other present. If it does, it will fallback to email and to a generated one after that. Maybe someone wants to merge users by username? Migration paths for existing installations should be discussed too.
• When there are no users in the app, the app redirects towards /register automatically. I had doubts with this. If OIDC_ENABLED=true, should it now:
  • Redirect towards /login?
  • Redirect towards /login, but adding a Sign up button?
    I'm open to ideas with this one
• Maybe a new env var to disallow user/password authentication makes sense now.
• Session creation has duplicated code for SSO and user/password authentication, a refactor later would be nice.

I've only tested this against my own installation of Authentik and it's working fine.

[javedh-dev]

Hi @Alejandro-SB ,
Thanks for submitting the PR. Can you please resolve the conflicts and update the PR

[Alejandro-SB]

Hi @javedh-dev, branch is up to date now.
Do you have any opinions about the questions at the end of it? Happy to change whatever is needed.