feat(auth): Authentik OIDC sign-in + Gravatar avatars

Adds optional SSO via Authentik (or any OIDC provider) alongside the
existing password flow, and pulls profile images from the provider's
`picture` claim or Gravatar so the sharing UI stops looking anonymous.
Password login stays available as a recovery path; JIT provisioning and
admin-group mapping are env-configurable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/App.tsx

@@ -24,6 +24,7 @@ import { usePhotosQuery } from './hooks/usePhotosQuery'
 import { AuthProvider, useAuth } from './contexts/AuthContext'
 import { LoginPage } from './components/auth/LoginPage'
 import { SetupPage } from './components/auth/SetupPage'
+import { OidcCallback } from './components/auth/OidcCallback'
 import { TooltipProvider } from '@/components/ui/tooltip'
 
 function MainApp() {
@@ -185,6 +186,13 @@ function App() {
 function AuthGate() {
   const { user, isLoading, needsSetup } = useAuth()
 
+  // OIDC callback lands on /auth/callback — handle it even while
+  // isLoading, so the callback page can adopt tokens and transition
+  // straight to MainApp without flashing the login screen.
+  if (window.location.pathname.startsWith('/auth/callback')) {
+    return <OidcCallback />
+  }
+
   if (isLoading) {
     return (
       <div className="flex min-h-screen items-center justify-center bg-bg">