Sign in with Google or a generic OIDC provider

Hive now supports signing in through OpenID Connect. Operators can configure Google as a first-class provider with HIVE_GOOGLE_* environment variables, or wire any generic OIDC provider with HIVE_OIDC_*. The login page shows a button for each configured provider, and the allowlist enforces permitted email domains on callback. Provider buttons also render correctly on public instances in this release.