Add Authentik OIDC login as an additional sign-in option

Local auth stays the primary/always-available login (don't want to
lock out the saved admin password) — OIDC is additive, shown as a
second button when OIDC_ENABLED=true. Uses openid-client v6 with PKCE.

Authentik-side provider was set up via an authentik blueprint (its own
declarative automation, see docs/oidc-setup.md) rather than touching
any existing admin credentials.

Closes #12.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -13,8 +13,16 @@ SESSION_SECRET=
 ADMIN_USERNAME=admin
 ADMIN_PASSWORD=
 
-# local | oidc (oidc not implemented yet, see issue #12)
-AUTH_MODE=local
+# Local login (username/password above) is always available. Set this true to
+# additionally show a "Sign in with Authentik" button — see docs/oidc-setup.md
+# for how the Authentik provider was set up.
+OIDC_ENABLED=false
+OIDC_ISSUER_URL=https://192.168.1.208:9443/application/o/homelab-monitor/
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+OIDC_REDIRECT_URI=http://192.168.1.103:8090/api/auth/oidc/callback
+# Authentik's cert is self-signed on the LAN, same situation as Proxmox's API.
+OIDC_ALLOW_INSECURE_TLS=true
 
 # Set to true only once a TLS-terminating reverse proxy sits in front (see
 # issue #13). Leave false for plain-HTTP LAN access, otherwise the session