OIDC is pansy's primary login path (Authentik the target IdP); local
auth (#4) remains the fallback and both issue the same session cookie.

- deps: github.com/coreos/go-oidc/v3 + golang.org/x/oauth2 (both pure Go;
  CGO stays off).
- api/oidc.go: lazy issuer discovery (retried per-request, never crashes
  a server that also serves local auth), GET /auth/oidc/login builds an
  authorization-code URL with PKCE S256 + random state + nonce stashed in
  a short-lived HttpOnly cookie, GET /auth/oidc/callback verifies state
  (constant-time), exchanges the code with the PKCE verifier, verifies the
  ID token + nonce, and starts a pansy session. Failures redirect to
  /login?error=... ; success to /gardens.
- service.LoginOIDC: (issuer,subject) match -> login; else *verified*
  email match -> link onto the existing account; else JIT-create (the IdP
  gates access, so PANSY_REGISTRATION doesn't apply). Unverified email
  colliding with an existing account is refused (takeover guard); no email
  is refused (email is the account key). Reuses the atomic CreateUser.
- store: GetUserByOIDC + LinkOIDC (unique-pair backstop).
- config: OIDCReady() (needs issuer+client+BaseURL for the redirect URI);
  /auth/providers now reports oidc from it and defaults the button label
  to "Sign in with Authentik". OIDC routes are only registered when ready,
  so an unconfigured instance 404s them.
- PANSY_LOCAL_AUTH=false rejects/hides local auth but not OIDC.

Tests: service provisioning (JIT, repeat login, link, unverified-collision
refusal, no-email, name fallback, works with local auth off); api
(routes-absent-when-unconfigured, providers reporting, login redirect with
PKCE params + tx cookie via a fake discovery server, callback state/error
paths). Smoke-tested: unreachable issuer degrades to error=oidc_unavailable
with the server still up and local auth working.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

@@ -0,0 +60,4 @@
+// ensure performs discovery once (idempotent) and builds the verifier + oauth2
+// config. Safe for concurrent callers; a failure leaves the client uninitialized
+// so the next request retries.
+func (o *oidcClient) ensure(ctx context.Context) error {

@@ -0,0 +127,4 @@
+// verifier), verify the ID token and nonce, provision/link the user, and start a
+// pansy session. Every failure clears the tx cookie and redirects to the login
+// page with an error code rather than leaking details to the browser.
+func (h *handlers) oidcCallback(c *gin.Context) {

@@ -0,0 +155,4 @@
+		return
+	}
+
+	code := c.Query("code")

@@ -0,0 +161,4 @@
+		return
+	}
+
+	token, err := h.oidc.oauth.Exchange(ctx, code, oauth2.VerifierOption(tx.Verifier))

@@ -0,0 +212,4 @@
+		Name:          name,
+	})
+	if err != nil {
+		slog.Warn("api: oidc provisioning failed", "error", err)

@@ -0,0 +226,4 @@
+}
+
+// setOIDCTxCookie writes the login transaction as a compact base64 JSON cookie.
+func (h *handlers) setOIDCTxCookie(c *gin.Context, tx oidcTx) {

@@ -0,0 +250,4 @@
+		return oidcTx{}, false
+	}
+	var tx oidcTx
+	if err := json.Unmarshal(raw, &tx); err != nil || tx.State == "" || tx.Verifier == "" {

@@ -0,0 +262,4 @@
+}
+
+// randToken returns 32 bytes of URL-safe randomness for state/nonce values.
+func randToken() (string, error) {

@@ -44,0 +64,4 @@
+// An unverified email that collides with an existing account is refused (it
+// would let anyone who can assert that email at the IdP take over the account).
+// An identity with no email can't be provisioned (email is the account key).
+func (s *Service) LoginOIDC(ctx context.Context, id OIDCIdentity) (*domain.User, error) {

@@ -44,0 +90,4 @@
+		if !id.EmailVerified {
+			return nil, domain.ErrOIDCEmailUnverified
+		}
+		return s.store.LinkOIDC(ctx, existing.ID, id.Issuer, id.Subject)

@@ -44,0 +100,4 @@
+	if name == "" {
+		name = emailLocalPart(email)
+	}
+	return s.store.CreateUser(ctx, &domain.User{

@@ -293,0 +290,4 @@
+	// OIDC configured with a base URL → reported ready.
+	ready := openConfig()
+	ready.BaseURL = "https://pansy.example.com"
+	ready.OIDC = config.OIDCConfig{Issuer: "https://idp.example", ClientID: "cid", ButtonLabel: "Sign in with Authentik"}

@@ -108,0 +124,4 @@
+// another user's identity pair trips the UNIQUE index and maps to ErrEmailTaken
+// as a generic conflict (it shouldn't happen — the caller looks up by identity
+// first — but the index is the backstop).
+func (d *DB) LinkOIDC(ctx context.Context, userID int64, issuer, subject string) (*domain.User, error) {

@@ -108,0 +134,4 @@
+		issuer, subject, userID,
+	)
+	if err != nil {
+		if isUniqueViolation(err) {