v1.3.0 — Sign in with Authentik (OIDC)

ROMarr v1.3.0 — sign in with Authentik, or any OpenID Connect provider.

OIDC sign-in (#56). The login page gains a "Sign in with …" button. ROMarr becomes the relying party in an authorization-code + PKCE flow, so a directly-reachable install — no reverse proxy required — can authenticate people through an external IdP. Works with Authentik, Keycloak, Zitadel, Google, or anything else speaking OIDC.

• Configure it under Settings → General → Sign in with an identity provider (OIDC), or entirely in the environment (ROMARR_OIDC_ISSUER, ROMARR_OIDC_CLIENT_ID, ROMARR_OIDC_CLIENT_SECRET, ROMARR_OIDC_GROUP, …). Endpoint discovery via /.well-known/openid-configuration, with manual URL overrides for IdPs behind path rewriters. The callback to register is <public_url>/oidc/callback.
• Optional access control: a required group or an email allowlist. A missing groups claim fails a group restriction rather than satisfying it.
• Security: PKCE S256 always; state checked before any token exchange (CSRF); nonce binds the id_token to the login (replay); id_token validated claim-by-claim (iss/aud/exp/iat/azp) and signature-verified against the JWKS when cryptography is installed. Without it, RS256 falls back to OIDC Core §3.1.3.7 channel trust over https only — an http issuer with no verifier is refused. Client secret stored write-only. Full trust model in SECURITY.md; open-path table now twelve routes.
• This complements the existing forward-auth SSO (ROMARR_AUTH=forward), which believes a proxy's headers; both can be understood as "SSO" but they answer different deployments.

41 new tests (unit + HTTP-layer: redirect cookies, state-mismatch refused pre-exchange, every claim-refusal path, HS256 verify/reject, no-crypto https fallback + http refusal, secret write-only). Full suite: 2225 passed, 3 skipped.