refactor: architecture cleanup — OIDC dedup, PKCE, K8s hardening

- Extract OidcProviderHelper for shared discovery + JWK source construction
- Add SystemRole.normalizeScope() to centralize role normalization
- Merge duplicate claim extraction in OidcTokenExchanger
- Add PKCE (S256) to OIDC authorization flow (frontend + backend)
- Add SecurityContext (runAsNonRoot) to all K8s deployments
- Fix postgres probe to use $POSTGRES_USER instead of hardcoded username
- Remove default credentials from Dockerfile
- Extract sanitize_branch() to shared .gitea/sanitize-branch.sh
- Fix sidebar to use /exchanges/ paths directly, remove legacy redirects
- Centralize basePath computation in router.tsx via config module

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/auth/OidcCallback.tsx

@@ -59,7 +59,9 @@ export function OidcCallback() {
     }
 
     const redirectUri = `${window.location.origin}${config.basePath}oidc/callback`;
-    loginWithOidcCode(code, redirectUri);
+    const codeVerifier = sessionStorage.getItem('oidc-code-verifier') ?? undefined;
+    sessionStorage.removeItem('oidc-code-verifier');
+    loginWithOidcCode(code, redirectUri, codeVerifier);
   }, [loginWithOidcCode]);
 
   if (isAuthenticated) return <Navigate to="/" replace />;