Configurable OIDC login with Google and generic provider support

OIDC login is now available out of the box for Google and any generic provider. You can choose between them with HIVE_OIDC_PROVIDER=google|generic, and configure a single provider using HIVE_OIDC_CLIENT_ID, HIVE_OIDC_CLIENT_SECRET, and optional HIVE_OIDC_ALLOWED_DOMAINS to restrict sign-in to specific email domains. The login page displays one button per configured provider and routes authentication through /auth/:provider and /auth/:provider/callback.