feat: auto-redirect to OIDC provider for true SSO

When OIDC is configured, the login page automatically redirects to the
provider with prompt=none. If the user has an active OIDC session, they
are signed in without seeing a login page. If the provider returns
login_required (no session), falls back to the login form via ?local.
Users can bypass auto-redirect with /login?local.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/auth/OidcCallback.tsx

@@ -18,6 +18,11 @@ export function OidcCallback() {
     const errorParam = params.get('error');
 
     if (errorParam) {
+      // prompt=none SSO attempt failed (no active session) — fall back to login form
+      if (errorParam === 'login_required' || errorParam === 'interaction_required') {
+        window.location.replace(`${config.basePath}login?local`);
+        return;
+      }
       useAuthStore.setState({
         error: params.get('error_description') || errorParam,
         loading: false,