feat(auth): pluggable OIDC provider (Keycloak / Entra / generic)

[hweej]

Make the OIDC provider configurable per deployment (Keycloak / Microsoft Entra / generic OIDC), with zero config change for existing Keycloak deployments (prod on EKS keeps working as-is).

What changed

• config.py: added AUTH_PROVIDER + OIDC_* settings and resolved_* properties (issuer, client id/secret, audience, scopes, roles-claims, idp-hint, discovery URL). AUTH_PROVIDER defaults to keycloak and reads the existing KEYCLOAK_* vars.
• auth/oidc.py (new, replaces auth/keycloak.py): generic OidcClient — resolves endpoints from .well-known/openid-configuration, extracts roles from configurable dotted claim-paths (extract_roles), configurable scopes/audience, logout via the discovered end_session_endpoint.
• Cutover: main.py + cli/main.py construct OidcClient and discover() → fetch_jwks() at startup; all consumers use app.state.oidc.
• .env.example: documents AUTH_PROVIDER + OIDC_* with an Entra example.

Provider role defaults (approach C — presets over a generic mechanism): keycloak → realm_access.roles + resource_access.{client}.roles; entra → roles; overridable via OIDC_ROLES_CLAIMS. Audience = client id for all (Keycloak already validated this).

Test plan

• 321 backend tests pass. Backward-compat is directly tested (Keycloak-only config resolves identically; dual-role merge; issuer/audience). New providers covered (Entra roles, wrong-aud/wrong-iss rejection, discovery parsing).
• Entra end-to-end — needs a real Entra tenant + app registration (App Roles → roles claim, OIDC_AUDIENCE if the access-token aud isn't the bare client id). To verify locally once Entra is set up.

Follow-up: standardize on OIDC_* / deprecate KEYCLOAK_* aliases (#174).