oidc: authenticate SPA users via Authentik

- Add OIDC proxy endpoints (GET config, POST token) to API server
- Implement PKCE Authorization Code flow in SPA
- Enable Authentik login tab in Config page
- Handle callback + auto-refresh + session restore
- Add restart: unless-stopped to all persistent services
- Configure OIDC issuer + client_id in docker-compose

internal/config/config.go

@@ -19,10 +19,11 @@ type Config struct {
 	APIEnv    string // dev, prod
 
 	// Auth (Phase 2: static bearer tokens + OIDC JWT)
-	APIToken       string // operator/CI bearer token for the REST API
-	MCPBearerToken string // shared secret for Nomos→API MCP calls
-	OIDCIssuer     string // OIDC issuer URL for JWT validation (e.g. https://authentik.example.com/application/o/oikos/)
-	OIDCClientID   string // OIDC client ID (aud claim expected in JWT)
+	APIToken         string // operator/CI bearer token for the REST API
+	MCPBearerToken   string // shared secret for Nomos→API MCP calls
+	OIDCIssuer       string // OIDC issuer URL for JWT validation (e.g. https://authentik.example.com/application/o/oikos/)
+	OIDCClientID     string // OIDC client ID (aud claim expected in JWT)
+	OIDCClientSecret string // optional client secret for token endpoint proxy (confidential clients)
 
 	// CORS (client/server split — see plans/2026-07-12-wails-desktop-app.md
 	// 0.3). Needed for the Wails webview and local dev (Vite on a different
@@ -108,6 +109,9 @@ func FromEnv() Config {
 	if v := os.Getenv("OIKOS_OIDC_CLIENT_ID"); v != "" {
 		c.OIDCClientID = v
 	}
+	if v := os.Getenv("OIKOS_OIDC_CLIENT_SECRET"); v != "" {
+		c.OIDCClientSecret = v
+	}
 	if v := os.Getenv("OIKOS_API_TOKEN"); v != "" {
 		c.APIToken = v
 	}