feat: generic OIDC role extraction from access token

The OIDC login flow now reads roles from the access_token (JWT) in
addition to the id_token. This fixes role extraction with providers
like Logto that put scopes/roles in access tokens rather than id_tokens.

- Add audience and additionalScopes to OidcConfig for RFC 8707 resource
  indicator support and configurable extra scopes
- OidcTokenExchanger decodes access_token with at+jwt-compatible processor,
  falls back to id_token if access_token is opaque or has no roles
- syncOidcRoles preserves existing local roles when OIDC returns none
- SPA includes resource and additionalScopes in authorization requests
- Admin UI exposes new config fields

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/auth/OidcCallback.tsx

@@ -27,15 +27,27 @@ export function OidcCallback() {
       // consent_required — retry without prompt=none so user can grant scopes
       if (errorParam === 'consent_required' && !sessionStorage.getItem('oidc-consent-retry')) {
         sessionStorage.setItem('oidc-consent-retry', '1');
-        api.GET('/auth/oidc/config').then(({ data }) => {
+        api.GET('/auth/oidc/config').then(async ({ data }) => {
           if (data?.authorizationEndpoint && data?.clientId) {
             const redirectUri = `${window.location.origin}${config.basePath}oidc/callback`;
+            const array = new Uint8Array(32);
+            crypto.getRandomValues(array);
+            const verifier = btoa(String.fromCharCode(...array))
+              .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+            sessionStorage.setItem('oidc-code-verifier', verifier);
+            const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+            const challenge = btoa(String.fromCharCode(...new Uint8Array(digest)))
+              .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+            const scopes = ['openid', 'email', 'profile', ...(data.additionalScopes || [])];
             const p = new URLSearchParams({
               response_type: 'code',
               client_id: data.clientId,
               redirect_uri: redirectUri,
-              scope: 'openid email profile',
+              scope: scopes.join(' '),
+              code_challenge: challenge,
+              code_challenge_method: 'S256',
             });
+            if (data.resource) p.set('resource', data.resource);
             window.location.href = `${data.authorizationEndpoint}?${p}`;
           }
         }).catch(() => {