Add OIDC admin config page with auto-signup toggle

Backend: add autoSignup field to OidcConfig, ClickHouse schema, repository,
and admin controller. Gate OIDC login when auto-signup is disabled and user
is not pre-created (returns 403).

Frontend: add OIDC admin page with full CRUD (save/test/delete), role-gated
Admin nav link parsed from JWT, and matching design system styles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/components/layout/TopNav.tsx

@@ -5,7 +5,7 @@ import styles from './TopNav.module.css';
 
 export function TopNav() {
   const { theme, toggle } = useThemeStore();
-  const { username, logout } = useAuthStore();
+  const { username, roles, logout } = useAuthStore();
 
   return (
     <nav className={styles.topnav}>
@@ -23,6 +23,13 @@ export function TopNav() {
             Transactions
           </NavLink>
         </li>
+        {roles.includes('ADMIN') && (
+          <li>
+            <NavLink to="/admin/oidc" className={({ isActive }) => isActive ? styles.navLinkActive : styles.navLink}>
+              Admin
+            </NavLink>
+          </li>
+        )}
       </ul>
 
       <div className={styles.navRight}>