Add OIDC login via Authentik: PKCE, JIT provisioning, email linking (#5)

OIDC is pansy's primary login path (Authentik the target IdP); local
auth (#4) remains the fallback and both issue the same session cookie.

- deps: github.com/coreos/go-oidc/v3 + golang.org/x/oauth2 (both pure Go;
  CGO stays off).
- api/oidc.go: lazy issuer discovery (retried per-request, never crashes
  a server that also serves local auth), GET /auth/oidc/login builds an
  authorization-code URL with PKCE S256 + random state + nonce stashed in
  a short-lived HttpOnly cookie, GET /auth/oidc/callback verifies state
  (constant-time), exchanges the code with the PKCE verifier, verifies the
  ID token + nonce, and starts a pansy session. Failures redirect to
  /login?error=... ; success to /gardens.
- service.LoginOIDC: (issuer,subject) match -> login; else *verified*
  email match -> link onto the existing account; else JIT-create (the IdP
  gates access, so PANSY_REGISTRATION doesn't apply). Unverified email
  colliding with an existing account is refused (takeover guard); no email
  is refused (email is the account key). Reuses the atomic CreateUser.
- store: GetUserByOIDC + LinkOIDC (unique-pair backstop).
- config: OIDCReady() (needs issuer+client+BaseURL for the redirect URI);
  /auth/providers now reports oidc from it and defaults the button label
  to "Sign in with Authentik". OIDC routes are only registered when ready,
  so an unconfigured instance 404s them.
- PANSY_LOCAL_AUTH=false rejects/hides local auth but not OIDC.

Tests: service provisioning (JIT, repeat login, link, unverified-collision
refusal, no-email, name fallback, works with local auth off); api
(routes-absent-when-unconfigured, providers reporting, login redirect with
PKCE params + tx cookie via a fake discovery server, callback state/error
paths). Smoke-tested: unreachable issuer degrades to error=oidc_unavailable
with the server still up and local auth working.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/api/api.go

@@ -19,8 +19,9 @@ import (
 // handlers carries the dependencies shared by every HTTP handler. Handlers stay
 // thin: decode the request, call a service method, encode the result.
 type handlers struct {
-	cfg *config.Config
-	svc *service.Service
+	cfg  *config.Config
+	svc  *service.Service
+	oidc *oidcClient // nil unless OIDC is configured (see config.OIDCReady)
 }
 
 // New builds the gin engine with the standard middleware stack and registers the
@@ -59,6 +60,19 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 	auth.GET("/providers", h.providers)
 	auth.GET("/me", h.requireAuth(), h.me)
 
+	// OIDC routes exist only when OIDC can actually be offered, so an unconfigured
+	// instance 404s them (matching what /auth/providers advertises). Provider
+	// discovery is lazy (first request), so a briefly-unreachable IdP doesn't stop
+	// the server — or local auth — from starting.
+	switch {
+	case cfg.OIDCReady():
+		h.oidc = newOIDCClient(cfg)
+		auth.GET("/oidc/login", h.oidcLogin)
+		auth.GET("/oidc/callback", h.oidcCallback)
+	case cfg.OIDC.Enabled():
+		slog.Warn("api: OIDC is configured but PANSY_BASE_URL is unset; OIDC disabled (an absolute redirect URI is required)")
+	}
+
 	return r
 }