Move OIDC config from env vars to database with admin API

OIDC provider settings (issuer, client ID/secret, roles claim) are
now stored in ClickHouse and managed via admin REST API at
/api/v1/admin/oidc. This allows runtime configuration from the UI
without server restarts.

- New oidc_config table (ReplacingMergeTree, singleton row)
- OidcConfig record + OidcConfigRepository interface in core
- ClickHouseOidcConfigRepository implementation
- OidcConfigAdminController: GET/PUT/DELETE config, POST test
  connectivity, client_secret masked in responses
- OidcTokenExchanger: reads config from DB, invalidateCache()
  on config change
- OidcAuthController: always registered (no @ConditionalOnProperty),
  returns 404 when OIDC not configured
- Startup seeder: env vars seed DB on first boot only, then admin
  API takes over
- HOWTO.md updated with admin OIDC config API examples

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

clickhouse/init/04-oidc-config.sql

@@ -0,0 +1,11 @@
+CREATE TABLE IF NOT EXISTS oidc_config (
+    config_id      String DEFAULT 'default',
+    enabled        Bool DEFAULT false,
+    issuer_uri     String DEFAULT '',
+    client_id      String DEFAULT '',
+    client_secret  String DEFAULT '',
+    roles_claim    String DEFAULT 'realm_access.roles',
+    default_roles  Array(LowCardinality(String)),
+    updated_at     DateTime64(3, 'UTC') DEFAULT now64(3, 'UTC')
+) ENGINE = ReplacingMergeTree(updated_at)
+ORDER BY (config_id);