Sign in with Google or a generic OIDC provider

The login page now supports configurable OIDC authentication. You can enable Google as a preset provider with HIVE_GOOGLE_CLIENT_ID and HIVE_GOOGLE_CLIENT_SECRET, or connect any OIDC issuer with HIVE_OIDC_ISSUER, HIVE_OIDC_CLIENT_ID, and related variables. Provider buttons now appear correctly on public instances, and an optional email-domain allowlist restricts who can sign in.