oidc: authenticate SPA users via Authentik

- Add OIDC proxy endpoints (GET config, POST token) to API server
- Implement PKCE Authorization Code flow in SPA
- Enable Authentik login tab in Config page
- Handle callback + auto-refresh + session restore
- Add restart: unless-stopped to all persistent services
- Configure OIDC issuer + client_id in docker-compose

web/src/App.svelte

@@ -13,6 +13,7 @@
   import { connectionState } from '$lib/stores/events'
   import { isConfigured } from '$lib/config'
   import { onMount } from 'svelte'
+  import { processPendingCallback, initOIDC } from '$lib/oidc'
   import * as Sidebar from '$lib/components/ui/sidebar'
   import * as Sheet from '$lib/components/ui/sheet'
   import { Button } from '$lib/components/ui/button'
@@ -37,7 +38,13 @@
   const approvalsPending = $derived($summary?.approvals_pending ?? 0)
   const openSignals = $derived(openSignalCount($summary))
 
-  onMount(() => {
+  onMount(async () => {
+    if (await processPendingCallback()) {
+      configured = true
+    } else if (!configured) {
+      if (await initOIDC()) configured = true
+    }
+
     function sync() {
       const path = location.hash.slice(2) || 'overview'
       const [head, ...rest] = path.split('/')