Support configurable OIDC login with Google and generic providers

Adds a configurable, provider-keyed OIDC login flow at /auth/:provider. Google is available as a first-class provider with hardcoded endpoints, and a generic OIDC provider can be configured by supplying an issuer URL. The login screen renders one button per configured provider. Domain allowlists can be enforced on the callback to restrict sign-in, and a single allowed Google domain also adds the hd= hosted-domain hint to the account picker. The implementation delegates state, PKCE, token exchange, and discovery to Ueberauth + ueberauth_oidcc.