Add OIDC admin config page with auto-signup toggle

Backend: add autoSignup field to OidcConfig, ClickHouse schema, repository,
and admin controller. Gate OIDC login when auto-signup is disabled and user
is not pre-created (returns 403).

Frontend: add OIDC admin page with full CRUD (save/test/delete), role-gated
Admin nav link parsed from JWT, and matching design system styles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/router.tsx

@@ -3,6 +3,7 @@ import { AppShell } from './components/layout/AppShell';
 import { ProtectedRoute } from './auth/ProtectedRoute';
 import { LoginPage } from './auth/LoginPage';
 import { ExecutionExplorer } from './pages/executions/ExecutionExplorer';
+import { OidcAdminPage } from './pages/admin/OidcAdminPage';
 
 export const router = createBrowserRouter([
   {
@@ -17,6 +18,7 @@ export const router = createBrowserRouter([
         children: [
           { index: true, element: <Navigate to="/executions" replace /> },
           { path: 'executions', element: <ExecutionExplorer /> },
+          { path: 'admin/oidc', element: <OidcAdminPage /> },
         ],
       },
     ],