Configurable OIDC and Google sign-in

Hive now supports sign-in through either a generic OpenID Connect provider or a Google preset. You can configure one provider per instance with HIVE_OIDC_PROVIDER=google|generic, or alternatively use the Google-specific HIVE_GOOGLE_CLIENT_ID and HIVE_GOOGLE_CLIENT_SECRET variables. The generic OIDC path lets you point HIVE_OIDC_ISSUER at any provider that exposes a .well-known/openid-configuration endpoint, then supply HIVE_OIDC_CLIENT_ID and HIVE_OIDC_CLIENT_SECRET. The login page shows the corresponding Continue button automatically, and the callback is /auth/:provider/callback. Domain allowlists via HIVE_GOOGLE_ALLOWED_DOMAINS or HIVE_OIDC_ALLOWED_DOMAINS restrict which email domains can sign in, and Google gets a hosted-domain hint when a single domain is configured.