Phase 1: add OIDC client (redirect/callback/token/session) with proxyAuth header fallback

No manifest change yet — proxyAuth stays active, so get_identity() still works
via header. OIDC routes only activate when CLOUDRON_OIDC_* env vars are present.
Validates id_token signature (JWKS), iss/aud/nonce, exp/nbf.

requirements.txt

@@ -1,3 +1,5 @@
 fastapi==0.115.0
 uvicorn[standard]==0.30.6
 httpx==0.27.2
+authlib==1.3.0
+itsdangerous==2.1.2