Add generic external SSO / OIDC login provider

[hokiepokedad2]

@

Summary

Add a generic, admin-configurable external OIDC/OAuth2 login provider to PoracleWeb, so any self-hoster can point the app at their own identity provider. It mirrors the existing Discord login flow, parameterized by config.

PGAN context: this lets PoracleWeb (alerts.pogoalerts.net) delegate login to the PogoAlerts OAuth2/OIDC server (pogoalerts.net) for true single sign-on across the PogoAlerts main site, ReactMap, and PoracleWeb — but the feature is provider-agnostic.

Approach

A parameterized twin of the Discord OAuth flow. Provider config (authorize/token/userinfo URLs, client id/secret, claim mapping, display name) comes from env/appsettings — same two-layer model as Discord: server config = "configured", plus an enable_oidc site setting = admin runtime toggle. After userinfo returns, a configurable identity claim (default discord_id) is looked up in the Poracle human table exactly like the Discord path; existing role gating is reused; the existing internal JWT is minted via IJwtService. No change to how PoracleWeb issues/validates its own tokens.

Scope

Backend

• OidcSettings config class (URLs, client id/secret, scopes, claim mapping, PKCE flag, provider name)
• Program.cs env var bridge (OIDC_* -> Oidc__*) + DI binding; document in .env.example (no startup hard-validation — provider is optional)
• AuthController: GET /api/auth/oidc/login (state + PKCE) and GET /api/auth/oidc/callback (code exchange -> userinfo -> human lookup -> role gate -> JWT)
• Extend Providers() with an oidc block (configured / enabledByAdmin / providerName)
• enable_oidc in SettingsMigrationService (BooleanKeys + CategoryMap)

Frontend (ClientApp)

• AuthProviders model gains oidc
• auth.service.ts loginWithOidc(); /auth/oidc/callback route (reuses CallbackComponent)
• Login page button + disabled hint; new oidc_* error codes in login + callback maps
• Admin-settings OIDC group with enable_oidc toggle
• i18n keys (AUTH.SIGN_IN_OIDC, AUTH.ERR_OIDC_*, ADMIN_SETTINGS.*_OIDC)

Tests

• Backend: extend Providers tests (oidc configured/enabledByAdmin) + /oidc/login redirect/state
• Frontend: loginWithOidc() + oidc button visibility specs

Out of scope (later passes)

• ReactMap install of the prewritten PogoAlerts Passport strategy
• PogoAlerts IdP: cross-subdomain .pogoalerts.net SSO cookie; secret hygiene
• Telegram parity in PogoAlerts (Discord-only for now)
  @