Sign in with Google or a generic OIDC provider

Sign in now supports Google and any generic OIDC provider via the same flow. Configure a provider at runtime, and the login screen renders a matching button. Domain allowlists keep access restricted to approved email domains.