feat: enhance OIDC flow with audit logs and improved error handling

- add audit events for OIDC login and user provisioning
- improve callback error messages and state validation
- add OIDC provider schema and initial migration

server/.env.example

@@ -25,6 +25,13 @@ APP_DATA_PATH=../local/data
 # OIDC (optional — configure via admin settings UI; these are just for reference)
 # OIDC config is stored in the database (app_settings table, key: oidc_config)
 
+# OIDC runtime tuning (optional — uncomment to override defaults)
+# OIDC_STATE_TTL_SECS=600
+# OIDC_DISCOVERY_CACHE_TTL_SECS=3600
+# OIDC_JWKS_CACHE_TTL_SECS=3600
+# OIDC_CLOCK_TOLERANCE_SECS=30
+# OIDC_TOKEN_EXCHANGE_TIMEOUT_MS=10000
+
 # App URL (used for building password reset links in emails)
 APP_URL=http://localhost:5173