feat(auth): Authentik OIDC sign-in + Gravatar avatars

Adds optional SSO via Authentik (or any OIDC provider) alongside the
existing password flow, and pulls profile images from the provider's
`picture` claim or Gravatar so the sharing UI stops looking anonymous.
Password login stays available as a recovery path; JIT provisioning and
admin-group mapping are env-configurable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/components/heaps/HeapsPanel.tsx

@@ -521,8 +521,12 @@ export function HeapsPanel() {
                       navigateToSection(`heap-${sh.id}`, { heapId: sh.id })
                     }
                   >
-                    <Avatar name={sh.owner_username} size="xs" />
-                    <span className="truncate" title={`${sh.name} (shared by ${sh.owner_username})`}>
+                    <Avatar
+                      name={sh.owner_username}
+                      imageUrl={sh.owner_avatar_url}
+                      size="xs"
+                    />
+                    <span className="truncate" title={`${sh.name} (shared by ${sh.owner_display_name || sh.owner_username})`}>
                       {sh.name}
                     </span>
                     <PermissionIcon