Add Authentik OIDC auth (issue #10) + client portal /my-bookings (issue #13)

- api/auth.js: zero-dep OIDC authorization-code flow with PKCE against
  Authentik; HMAC-signed HttpOnly session cookies (SESSION_SECRET)
- requireAdmin now accepts an OIDC session in the admin group; legacy
  ADMIN_SECRET bearer kept for n8n and scripts
- New client endpoints: GET /api/my-bookings, owner-gated contract download
- Bookings created while signed in are bound to the client's OIDC sub
- Dashboard: "Sign in with SSO" alongside passphrase fallback
- New /my-bookings portal page (nginx route + themed page)
- Fix booking modal: content area now scrolls; nav no longer overlaps the
  calendar on short viewports (was swallowing clicks on date cells)
- 10 new Playwright tests; suite green at 67

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

api/.env.example

@@ -19,8 +19,12 @@ CONTRACT_SIG_Y=700
 CONTRACT_SIG_PAGE=1
 
 # OIDC / Authentik (issue #10)
+# Issuer is the Authentik provider URL, e.g. https://auth.jerodrigged.com/application/o/lisilou/
+# Redirect URI must be registered on the provider, e.g. https://lisilou.jerodrigged.com/api/auth/callback
 SESSION_SECRET=
 OIDC_ISSUER=
 OIDC_CLIENT_ID=
 OIDC_CLIENT_SECRET=
 OIDC_REDIRECT_URI=
+# Authentik group whose members get admin access (default: lisilou-admin)
+OIDC_ADMIN_GROUP=lisilou-admin