fix(auth): enable OIDC login with Jellyfin account matching
- Add OIDC authorization-code login and callback handling with signed state and PKCE
- Exchange OIDC codes for tokens and surface provider callback errors on the login page
- Match OIDC users to Jellyfin accounts using username-style claims, including username, preferred_username, name, email, and email local-part
- Issue JellyGlance tokens with the matched Jellyfin user, role, permissions, and avatar/profile context
- Preserve OIDC as the configured default while allowing Jellyfin Quick Connect as a fallback login path
- Prefer matched Jellyfin profile images for OIDC account display