Add OIDC desktop callback, app logo, rename to Oikos

- Server: /oidc-callback HTML page exchanges Authentik code for token,
  displays it for user to copy into the desktop app's Token tab
- oidc.ts: desktop mode uses apiUrl+/oidc-callback as redirect URI,
  encodes PKCE verifier in state parameter
- Config.svelte: add Server URL field to OIDC tab for desktop UX
- Caddy: add /oidc-callback to enroll bypass (no Authentik gate)
- App: favicon.png as system tray icon, window title 'Oikos'
- web/index.html: title 'Oikos'

web/src/lib/oidc.ts

@@ -1,4 +1,4 @@
-import { apiBase } from './config'
+import { apiBase, getConfig } from './config'
 
 interface OIDCConfig {
   issuer: string
@@ -77,7 +77,19 @@ export async function startLogin(): Promise<void> {
   sessionStorage.setItem(PKCE_KEY, codeVerifier)
   sessionStorage.setItem(STATE_KEY, oidcState)
 
-  const redirectURI = (location.origin + location.pathname).replace(/\/$/, '')
+  const isDesktop = getConfig().isDesktop === true
+
+  let redirectURI: string
+  let stateParam: string
+
+  if (isDesktop) {
+    const c = getConfig()
+    redirectURI = (c.apiUrl || location.origin).replace(/\/$/, '') + '/oidc-callback'
+    stateParam = oidcState + '.' + codeVerifier
+  } else {
+    redirectURI = (location.origin + location.pathname).replace(/\/$/, '')
+    stateParam = oidcState
+  }
 
   const params = new URLSearchParams({
     response_type: 'code',
@@ -85,7 +97,7 @@ export async function startLogin(): Promise<void> {
     redirect_uri: redirectURI,
     code_challenge: codeChallenge,
     code_challenge_method: 'S256',
-    state: oidcState,
+    state: stateParam,
     scope: 'openid profile email'
   })