feat: add OIDC/SSO authentication (#3)

Add OpenID Connect (OIDC) authentication alongside existing
username/password login. Users can log in via any standards-compliant
OIDC provider (Keycloak, Authentik, Authelia, Google, Azure AD, Okta)
while preserving full backward compatibility.

- OIDC Fastify plugin with lazy discovery, PKCE, cookie-based sessions
- Login page OIDC button, auth hook updates, settings dialog badges
- 28 integration tests, OIDC setup guide with provider examples
- Fix pre-existing test failures (content-aware-crop, watermark, SVGZ)
- WAL checkpoint fix for SQLite test stability

Closes #3

# Conflicts:
#	apps/api/src/lib/env.ts
#	apps/api/src/routes/tools/watermark-image.ts
#	pnpm-lock.yaml
#	tests/integration/color-palette.test.ts
#	tests/integration/compare.test.ts
#	tests/integration/watermark-image.test.ts

packages/shared/src/i18n/en.ts

@@ -300,6 +300,19 @@ export const en = {
     loggingIn: "Logging in...",
     invalidCredentials: "Invalid username or password",
     connectionError: "Connection error",
+    signInWith: "Sign in with {provider}",
+    signInWithSso: "Sign in with SSO",
+    or: "or",
+    methodLocal: "Local",
+    methodOidc: "OIDC",
+    methodBoth: "Local + OIDC",
+    oidcAuthFailed: "Authentication failed. Please try again.",
+    oidcProviderUnreachable: "Could not reach the identity provider. Please try again later.",
+    oidcSessionExpired: "Login session expired. Please try again.",
+    oidcUserNotAuthorized:
+      "Your account is not authorized to access this application. Contact your administrator.",
+    oidcUserLimitReached: "User limit reached. Contact your administrator.",
+    passwordManagedByProvider: "Password changes are managed by your identity provider.",
   },
   pipeline: {
     title: "Automate",