Support CPM_AUTH_MODE=local|oidc. OIDC uses go-oidc with JIT user
provisioning and an optional email-domain allowlist. Adds auth config,
login and callback endpoints, a JWT signing-key bootstrap and
Provider/Subject fields on the user model. Includes OIDC allowlist tests.
