Sign in with any OpenID Connect provider

Any OpenID Connect issuer with a .well-known/openid-configuration endpoint can be wired up as a sign-in option, alongside Google. Configure HIVE_OIDC_ISSUER, HIVE_OIDC_CLIENT_ID, HIVE_OIDC_CLIENT_SECRET, HIVE_OIDC_DISPLAY_NAME (the button label, defaulting to ‘Identity provider’), and an optional HIVE_OIDC_ALLOWED_DOMAINS allowlist. Discovery happens at boot so the strategy is generic, and the login page renders one button per enabled provider.