Desktop OIDC: open system browser, capture callback on localhost

ConfigService.StartOIDCLogin():
- Fetches OIDC config from the API
- Generates PKCE params
- Starts local HTTP server on 127.0.0.1:18901
- Opens system browser to Authentik
- Captures callback directly (no copy-paste)
- Exchanges code for token, saves to keychain
- Returns token to SPA → auto-connects

Config.svelte detects Wails environment and calls the binding.

web/src/pages/Config.svelte

@@ -67,6 +67,24 @@
     error = ''
     oidcLoggingIn = true
     setConfig({ apiUrl: apiUrl.trim(), token: '' })
+
+    const wails = (window as any).wails
+    if (wails?.Call?.ByName) {
+      try {
+        const token = await wails.Call.ByName('StartOIDCLogin', apiUrl.trim())
+        if (token) {
+          setConfig({ apiUrl: apiUrl.trim(), token })
+          initConfig({ apiUrl: apiUrl.trim(), token })
+          onConnected()
+          return
+        }
+      } catch (e: any) {
+        error = e?.message || e || 'OIDC login failed'
+        oidcLoggingIn = false
+        return
+      }
+    }
+
     try {
       await startLogin()
     } catch (e: any) {