9d2e6f30a7
OIDC provider settings (issuer, client ID/secret, roles claim) are now stored in ClickHouse and managed via admin REST API at /api/v1/admin/oidc. This allows runtime configuration from the UI without server restarts. - New oidc_config table (ReplacingMergeTree, singleton row) - OidcConfig record + OidcConfigRepository interface in core - ClickHouseOidcConfigRepository implementation - OidcConfigAdminController: GET/PUT/DELETE config, POST test connectivity, client_secret masked in responses - OidcTokenExchanger: reads config from DB, invalidateCache() on config change - OidcAuthController: always registered (no @ConditionalOnProperty), returns 404 when OIDC not configured - Startup seeder: env vars seed DB on first boot only, then admin API takes over - HOWTO.md updated with admin OIDC config API examples Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>