Multi-provider OIDC login with Google built in

Authentication now supports multiple OIDC providers, with Google available out of the box, replacing the previously hand-rolled OAuth flow. A configurable OIDC login shell lets operators choose which login providers are presented, so self-hosted instances can plug in their own identity provider or stage the Google button alongside others.