Phase 1: add OIDC client with proxyAuth header fallback

Replicates the admin-panel OIDC pattern: redirect/callback/token exchange
(client_secret_post) / JWKS validate / signed session cookie. get_user_identity()
prefers the OIDC session and falls back to the proxyAuth header. Adds /logout
route (was previously only a link). No manifest change yet.

requirements.txt

@@ -2,3 +2,5 @@ fastapi==0.115.0
 uvicorn[standard]==0.30.6
 httpx==0.27.2
 jinja2==3.1.4
+authlib==1.3.0
+itsdangerous==2.1.2