Configurable OIDC login with Google or generic provider

Added a configurable OIDC login flow. Operators can now set HIVE_GOOGLE_CLIENT_ID, HIVE_GOOGLE_CLIENT_SECRET, and HIVE_GOOGLE_ALLOWED_DOMAINS for a first-class Google provider, or HIVE_OIDC_ISSUER, HIVE_OIDC_CLIENT_ID, HIVE_OIDC_CLIENT_SECRET, and HIVE_OIDC_DISPLAY_NAME for a generic provider. The login screen renders a button for each configured provider and routes to /auth/:provider. The release is intended as the first version that ships with a production-ready login shell, so this is the headline user-facing feature for 0.1.0.