Multi-provider OIDC sign-in with Google as a built-in provider

Login now supports multiple OIDC providers in parallel via Ueberauth and ueberauth_oidcc. Google is built in as a first-class option (configure HIVE_GOOGLE_CLIENT_ID, HIVE_GOOGLE_CLIENT_SECRET, and optional HIVE_GOOGLE_ALLOWED_DOMAINS, callback /auth/google/callback) and a generic provider works against any OpenID Connect issuer via HIVE_OIDC_ISSUER, HIVE_OIDC_CLIENT_ID, optional client secret, optional HIVE_OIDC_DISPLAY_NAME, and optional HIVE_OIDC_ALLOWED_DOMAINS (callback /auth/oidc/callback). Every configured provider renders as a button on the login page, single-domain allowlists pre-fill Google’s hd= account-picker hint, and the allowlist is enforced on the callback.