Add OIDC admin config page with auto-signup toggle

Backend: add autoSignup field to OidcConfig, ClickHouse schema, repository,
and admin controller. Gate OIDC login when auto-signup is disabled and user
is not pre-created (returns 403).

Frontend: add OIDC admin page with full CRUD (save/test/delete), role-gated
Admin nav link parsed from JWT, and matching design system styles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

clickhouse/init/04-oidc-config.sql

@@ -6,6 +6,7 @@ CREATE TABLE IF NOT EXISTS oidc_config (
     client_secret  String DEFAULT '',
     roles_claim    String DEFAULT 'realm_access.roles',
     default_roles  Array(LowCardinality(String)),
+    auto_signup    Bool DEFAULT true,
     updated_at     DateTime64(3, 'UTC') DEFAULT now64(3, 'UTC')
 ) ENGINE = ReplacingMergeTree(updated_at)
 ORDER BY (config_id);