Configurable OIDC login with Google preset and generic provider

Sign-in now supports standard OpenID Connect. You can choose Google as a preset provider by setting HIVE_OIDC_PROVIDER=google and HIVE_OIDC_CLIENT_ID/HIVE_OIDC_CLIENT_SECRET, or point at a generic OIDC issuer with HIVE_OIDC_PROVIDER=generic and the discovery URL. Optional HIVE_OIDC_ALLOWED_DOMAINS restricts which email domains are allowed, and a single domain for Google also adds Google’s hd= hint to pre-filter the account picker.