Make OIDC provider configurable

[eekdood]

Summary

This makes the cloud API OIDC implementation provider-agnostic instead of hard-coding Google as the only issuer.

The existing Google route and legacy response fields are preserved for compatibility, but the active provider is now configured through environment variables.

Closes: #12

Changes

• Add configurable OIDC issuer/client/scopes:
  • OIDC_ISSUER
  • OIDC_CLIENT_ID
  • OIDC_CLIENT_SECRET
  • OIDC_SCOPES
• Discover provider metadata and JWKS from the configured issuer.
• Verify ID tokens against the configured issuer and client ID.
• Add generic /oidc/login route while keeping /oidc/google.
• Return provider-agnostic adoption fields:
  • oidcToken
  • oidcClientId
  • oidcIssuer
• Preserve legacy oidcGoogle and clientId fields for existing device/UI compatibility.
• Remove the previous Google-only issuer check during device registration.
• Harden returnTo handling by trimming control characters, rejecting off-origin redirects, and falling back to the app devices page.

Compatibility

This intentionally does not rename database fields such as googleId. Those names are left in place to avoid a schema migration and keep this PR focused on behavior. A later cleanup PR can rename legacy Google-specific schema/code names after the provider-agnostic flow is vetted.

Testing

• npm run build
• npm test
• Fork GitHub Actions passed
• Manually tested with authentik:
  • cloud API behind Traefik
  • authentik OIDC provider
  • successful login redirect through /oidc/callback
  • authenticated /devices response

[CLAassistant]

All committers have signed the CLA.