Add OIDC login flow to UI and fix dark mode datetime picker icons

- Add "Sign in with SSO" button on login page (shown when OIDC is configured)
- Add /oidc/callback route to exchange authorization code for JWT tokens
- Add loginWithOidcCode action to auth store
- Treat issuer URI as complete discovery URL (no auto-append of .well-known)
- Update admin page placeholder to show full discovery URL format
- Fix datetime picker calendar icon visibility in dark mode (color-scheme)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/auth/auth-store.ts

@@ -10,6 +10,7 @@ interface AuthState {
   error: string | null;
   loading: boolean;
   login: (username: string, password: string) => Promise<void>;
+  loginWithOidcCode: (code: string, redirectUri: string) => Promise<void>;
   refresh: () => Promise<boolean>;
   logout: () => void;
 }
@@ -84,6 +85,38 @@ export const useAuthStore = create<AuthState>((set, get) => ({
     }
   },
 
+  loginWithOidcCode: async (code, redirectUri) => {
+    set({ loading: true, error: null });
+    try {
+      const res = await fetch(`${config.apiBaseUrl}/auth/oidc/callback`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ code, redirectUri }),
+      });
+      if (!res.ok) {
+        const body = await res.json().catch(() => ({}));
+        throw new Error(body.message || 'OIDC login failed');
+      }
+      const { accessToken, refreshToken } = await res.json();
+      const payload = JSON.parse(atob(accessToken.split('.')[1]));
+      const username = payload.sub ?? 'oidc-user';
+      persistTokens(accessToken, refreshToken, username);
+      set({
+        accessToken,
+        refreshToken,
+        username,
+        roles: parseRolesFromJwt(accessToken),
+        isAuthenticated: true,
+        loading: false,
+      });
+    } catch (e: unknown) {
+      set({
+        error: e instanceof Error ? e.message : 'OIDC login failed',
+        loading: false,
+      });
+    }
+  },
+
   refresh: async () => {
     const { refreshToken } = get();
     if (!refreshToken) return false;