feat(auth): Authentik OIDC sign-in + Gravatar avatars

Adds optional SSO via Authentik (or any OIDC provider) alongside the
existing password flow, and pulls profile images from the provider's
`picture` claim or Gravatar so the sharing UI stops looking anonymous.
Password login stays available as a recovery path; JIT provisioning and
admin-group mapping are env-configurable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -53,6 +53,23 @@ services:
       - SECRET_KEY=${SECRET_KEY:-mulita-dev-secret-change-me}
       - ACCESS_TOKEN_EXPIRE_MINUTES=${ACCESS_TOKEN_EXPIRE_MINUTES:-60}
       - REFRESH_TOKEN_EXPIRE_DAYS=${REFRESH_TOKEN_EXPIRE_DAYS:-30}
+      # Authentik / OIDC single sign-on. Leave OIDC_ENABLED=false to
+      # hide the SSO button and stick with username/password. When
+      # enabled, set OIDC_ISSUER to the Authentik provider URL (the one
+      # that serves /.well-known/openid-configuration), and paste the
+      # client id/secret from the Authentik application. OIDC_REDIRECT_URI
+      # must match the one registered on the Authentik side exactly —
+      # e.g. https://photovault.example.com/api/v1/auth/oidc/callback.
+      - OIDC_ENABLED=${OIDC_ENABLED:-false}
+      - OIDC_ISSUER=${OIDC_ISSUER:-}
+      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-}
+      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-}
+      - OIDC_REDIRECT_URI=${OIDC_REDIRECT_URI:-}
+      - OIDC_SCOPES=${OIDC_SCOPES:-openid profile email}
+      - OIDC_PROVIDER_LABEL=${OIDC_PROVIDER_LABEL:-Authentik}
+      - OIDC_ALLOW_SIGNUP=${OIDC_ALLOW_SIGNUP:-true}
+      - OIDC_ADMIN_GROUPS=${OIDC_ADMIN_GROUPS:-}
+      - SESSION_SECRET=${SESSION_SECRET:-}
       - LOG_LEVEL=${LOG_LEVEL:-INFO}
       - TZ=${TZ:-UTC}
     depends_on: