Multiple OIDC providers with Google built in

The auth controller is now a generic, provider-keyed start/callback flow exposed at /auth/:provider, so any number of OIDC providers can coexist on the login screen. Google is wired in as a first-class provider with hardcoded endpoints, driven by HIVE_GOOGLE_CLIENT_ID and HIVE_GOOGLE_CLIENT_SECRET, and an HIVE_GOOGLE_ALLOWED_DOMAINS email allowlist is enforced on the callback. When a single allowed domain is configured, Hive also pre-fills Google’s hosted-domain hint (hd=) on the authorize redirect.