OIDC login with Google preset and generic provider support

Hive Server now supports a configurable OIDC login flow with PKCE, session storage, and logout. You can point it at any OIDC provider via HIVE_OIDC_* environment variables, or choose HIVE_OIDC_PROVIDER=google to use Google as a preset provider with domain allowlisting and the account-picker hint. The login page automatically renders the configured provider button, and the callback is routed through /auth/:provider/callback.