feat(auth): Authentik OIDC sign-in + Gravatar avatars

Adds optional SSO via Authentik (or any OIDC provider) alongside the
existing password flow, and pulls profile images from the provider's
`picture` claim or Gravatar so the sharing UI stops looking anonymous.
Password login stays available as a recovery path; JIT provisioning and
admin-group mapping are env-configurable.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/components/sharing/NotificationBell.tsx

@@ -90,10 +90,16 @@ export function NotificationBell() {
                   className="flex flex-col gap-2 px-3 py-2.5"
                 >
                   <div className="flex items-start gap-2.5">
-                    <Avatar name={invite.owner_username} size="sm" />
+                    <Avatar
+                      name={invite.owner_username}
+                      imageUrl={invite.owner_avatar_url}
+                      size="sm"
+                    />
                     <div className="min-w-0 flex-1">
                       <div className="text-sm leading-tight text-text">
-                        <span className="font-medium">{invite.owner_username}</span>
+                        <span className="font-medium">
+                          {invite.owner_display_name || invite.owner_username}
+                        </span>
                         <span className="text-text-muted"> shared </span>
                         <span className="inline-flex items-center gap-1 align-baseline">
                           <TypeIcon className="inline h-3 w-3 text-text-muted" />