Add opt-in OIDC sign-in with session cookie and roles

Auth is enabled only when issuer, client id and client secret are all set;
otherwise the dashboard stays an open LAN dashboard. Provider endpoints are
discovered from <issuer>/.well-known/openid-configuration via Authlib, so no
provider-specific code is needed.

- auth.py: /auth/login, /auth/authorize, /auth/callback, /auth/logout (RP-initiated
  logout when the issuer advertises end_session_endpoint)
- users.py: atomic, lock-guarded data/users.json keyed by the OIDC sub
- role resolution: admin claim wins, else first user bootstraps as admin, else viewer
- api.py/app.py: session middleware and require_login/require_admin gating on every
  route except /health, /auth/* and /static
- config.py/main.py: UWUDASH_OIDC_* / UWUDASH_SESSION_* env vars plus --oidc-issuer
  and --public-url flags
- templates/login.html, static app.js/styles.css: sign-in page and settings UI

pyproject.toml

@@ -5,8 +5,10 @@ description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
+    "Authlib>=1.9.1",
     "fastapi>=0.162.0",
     "httpx>=0.28.1",
+    "itsdangerous>=2.2",
     "jinja2>=3.1.6",
     "uvicorn[standard]>=0.54.0",
 ]