feat(auth): Authentik OIDC sign-in + Gravatar avatars

Adds optional SSO via Authentik (or any OIDC provider) alongside the
existing password flow, and pulls profile images from the provider's
`picture` claim or Gravatar so the sharing UI stops looking anonymous.
Password login stays available as a recovery path; JIT provisioning and
admin-group mapping are env-configurable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/models/user.py

@@ -14,10 +14,24 @@ class User(Base):
     id = Column(String, primary_key=True, default=lambda: str(uuid.uuid4()))
     username = Column(String(50), unique=True, nullable=False, index=True)
     email = Column(String, unique=True, nullable=True)
-    hashed_password = Column(String, nullable=False)
+    # Nullable: OIDC-only users have no local password. Local accounts
+    # still always have one.
+    hashed_password = Column(String, nullable=True)
     role = Column(String, nullable=False, default='user')  # 'admin' | 'user'
     is_active = Column(Boolean, default=True)
     created_at = Column(DateTime, server_default=func.now())
 
     # Absolute path to this user's photo directory (e.g., "/photos/daniel")
     media_path = Column(String, nullable=False)
+
+    # OIDC identity — populated when a user signs in via Authentik (or any
+    # other OIDC provider later). `oidc_sub` is stable per provider, so
+    # lookups key on (oidc_issuer, oidc_sub). NULL for password-only users.
+    oidc_issuer = Column(String, nullable=True)
+    oidc_sub = Column(String, nullable=True)
+
+    # Profile bits that can come from OIDC claims or be filled in later.
+    # avatar_url wins over Gravatar when set; the /auth/me response
+    # computes the final avatar URL for the frontend.
+    avatar_url = Column(String, nullable=True)
+    display_name = Column(String, nullable=True)