feat(web): OIDC login button + cookie-based session bootstrap

The SvelteKit /login was username/password only; the legacy comment
even called out 'OIDC SSO ships in M4 when the IdP is wired up'.
Authentik is wired up now, so:

- /api/v1/config exposes ext.oidc when the IdP is configured. Fetch
  it on the login page and conditionally render "Sign in with
  {provider}", which kicks off /api/v1/oidc/login.
- After PhotoPrism completes the auth code exchange, it sets
  `auth_token` + `auth_session` cookies and redirects to siteUrl
  (/library/browse by default; the deployment's reverse proxy is
  expected to bounce that to /). bootstrapSessionFromCookies()
  reads those cookies, calls GET /api/v1/session/<id> with the
  cookie's token, and adopts the resulting session into the SPA
  store on mount.
- Root layout's auth guard now waits for the bootstrap pass before
  punting to /login, so a fresh OIDC return doesn't get redirected
  away before the session is read.

web/src/routes/+layout.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
 	import '../app.css';
+	import { onMount } from 'svelte';
 	import { browser } from '$app/environment';
 	import { goto } from '$app/navigation';
 	import { page } from '$app/state';
@@ -7,6 +8,7 @@
 	import { ModeWatcher } from 'mode-watcher';
 	import { Toaster } from 'svelte-sonner';
 	import { isAuthenticated } from '$lib/stores/session.svelte';
+	import { bootstrapSessionFromCookies } from '$lib/services/photoprism';
 	import { setLeftSidebarWidth, view } from '$lib/stores/view.svelte';
 	import { resizable } from '$lib/actions/resizable';
 	import { queryClient } from '$lib/queryClient';
@@ -16,11 +18,24 @@
 
 	let { children } = $props();
 
+	// Bootstrap state: the OIDC return drops the user back on `/` with
+	// PhotoPrism's auth_token/auth_session cookies set, but the SPA store
+	// is empty. We try to adopt the cookie session on first mount before
+	// the auth guard can punt to /login.
+	let bootstrapped = $state(false);
+
+	onMount(async () => {
+		if (!isAuthenticated()) {
+			await bootstrapSessionFromCookies();
+		}
+		bootstrapped = true;
+	});
+
 	// Auth guard. Anything outside /login requires a session; otherwise
 	// punt to the login page (which itself redirects authenticated users
-	// back to /).
+	// back to /). Held until the cookie bootstrap has had a chance to run.
 	$effect(() => {
-		if (!browser) return;
+		if (!browser || !bootstrapped) return;
 		const onLogin = page.url.pathname === '/login';
 		if (!isAuthenticated() && !onLogin) {
 			void goto('/login', { replaceState: true });