feat(oidc): backend-mediated OIDC login + session cookies + cli config

Adds the OpenID Connect login flow Dialectic.Frontend will drive. Pattern
mirrors Fabric.Backend.Center: SPA → /api/auth/oidc/start → IdP →
/api/auth/oidc/callback → 302 to SPA with one-time ticket in URL fragment
→ SPA POST /api/auth/oidc/exchange → HttpOnly session cookie set.

What's added:

  - internal/oidc/service.go — runtime OIDC service:
    * BuildAuthorizeURL (PKCE S256 + random state, 10min ttl)
    * HandleCallback (token exchange + ID token verify + ticket mint, 60s ttl)
    * ExchangeTicket (ticket → session JWT, HS256 24h)
    * VerifySession (cookie validation)
    * GetConfig/SetConfig with sync.Map-backed state/ticket stores
    * SweepExpired (call from background goroutine; clears stale entries)
  - internal/db/migrations/004_oidc_config.sql — single-row oidc_config
    table (issuer/client_id/client_secret/redirect_uri/post_login_redirect/
    scopes/enabled). Runtime-mutable via dialectic-cli.
  - internal/httpapi/handlers/auth.go — 5 endpoints:
    GET  /api/auth/oidc/status   — { enabled }
    GET  /api/auth/oidc/start    — 302 to IdP
    GET  /api/auth/oidc/callback — IdP returns; we 302 to SPA with ticket
    POST /api/auth/oidc/exchange — ticket → cookie + user
    GET  /api/auth/me            — current session user (401 if anon)
    POST /api/auth/logout        — clears cookie
  - internal/auth: replaces the OIDCBrowser Phase-2C stub with one that
    reads the session cookie via SessionVerifier; keeps dev-bypass
    behind cfg.OIDCOnly gate (set OIDC_ONLY=true in prod to disable
    dev-bypass entirely)
  - cmd/dialectic-cli/main.go — new binary; subcommand
    'config oidc [--issuer ... --client-id ... --client-secret ...
                  --callback-url ... --enabled true|false]'
    Runs against same DB the backend uses; reachable via
    'docker exec dialectic-backend dialectic-cli config oidc ...'
  - Dockerfile: build both binaries; put on PATH for docker exec

Config:

  - SESSION_SIGNING_KEY env: required in prod, ephemeral random in dev.
    HS256 secret for session JWTs. Stable across restarts (rotation
    invalidates every session — kill switch).
  - OIDC_ONLY env: 'true' disables the dev-bypass path entirely; use
    in prod once OIDC is configured.
  - OIDC_ISSUER + OIDC_CLIENT_ID env are no longer required at boot —
    they're advisory bootstrap values for the oidc_config DB row.

Deps:
  - github.com/coreos/go-oidc/v3 (discovery + JWKS verify)
  - golang.org/x/oauth2 (token exchange + PKCE)
  - github.com/golang-jwt/jwt/v5 (session JWT)
  - Bumped go.mod toolchain to 1.25.

Pairs with Dialectic.Frontend (next commit) which removes the
/agents/:id admin page and adds the login button + /oidc/callback
SPA route + AuthProvider that talks to these new endpoints.

internal/config/config.go

@@ -63,9 +63,26 @@ type Config struct {
 	// https://auth.hangman-lab.top/realms/hangman-lab
 	// Phase 2C ships this as configured-but-not-verified; Phase 4 wires
 	// real JWKS validation.
+	// OIDC env-bootstrap values — used to seed the oidc_config DB row
+	// at first boot if it's empty. Runtime mutation goes through the
+	// dialectic-cli `config oidc ...` subcommand → updates the DB row.
+	// Env-only mode is fine for greenfield deploys; once the DB row is
+	// populated and enabled, env values become advisory.
 	OIDCIssuer   string
 	OIDCClientID string
 
+	// OIDC_ONLY: when "true", disables the dev-bypass auth path on
+	// every browser-facing route. Use this in prod once the OIDC
+	// realm + client are configured so a leaked dev token can't
+	// authenticate anyone. Defaults false (dev/sim convenience).
+	OIDCOnly bool
+
+	// SessionSigningKey: HS256 secret for the session JWT we mint on
+	// /api/auth/oidc/exchange. MUST be stable across restarts (rotating
+	// invalidates every logged-in user — that's the desired side
+	// effect for emergency revocation). Random hex, ≥ 32 bytes.
+	SessionSigningKey string
+
 	// (Removed Aug 2026: all Fabric coupling — FabricSystemAPIKey,
 	// FabricGuildBaseURL, FabricAnnounceChannelID, FabricBotBearerToken.
 	// Backend no longer broadcasts lifecycle events to Fabric. The
@@ -95,6 +112,8 @@ func LoadFromEnv() (*Config, error) {
 		DialecticAdminAPIKey: os.Getenv("DIALECTIC_ADMIN_API_KEY"),
 		OIDCIssuer:           os.Getenv("OIDC_ISSUER"),
 		OIDCClientID:         os.Getenv("OIDC_CLIENT_ID"),
+		OIDCOnly:             os.Getenv("OIDC_ONLY") == "true",
+		SessionSigningKey:    os.Getenv("SESSION_SIGNING_KEY"),
 	}
 	if d := os.Getenv("ORCHESTRATOR_TICK_INTERVAL"); d != "" {
 		if parsed, err := time.ParseDuration(d); err == nil {
@@ -114,12 +133,14 @@ func LoadFromEnv() (*Config, error) {
 		if c.AgentAPIKeyPepper == "" {
 			missing = append(missing, "AGENT_API_KEY_PEPPER")
 		}
-		if c.OIDCIssuer == "" {
-			missing = append(missing, "OIDC_ISSUER")
-		}
-		if c.OIDCClientID == "" {
-			missing = append(missing, "OIDC_CLIENT_ID")
+		if c.SessionSigningKey == "" {
+			missing = append(missing, "SESSION_SIGNING_KEY")
 		}
+		// OIDC_ISSUER + OIDC_CLIENT_ID are no longer required env at
+		// boot — they're optional bootstrap values for the oidc_config
+		// DB row (mutated via cli). If you start prod without them and
+		// without configuring via cli, the SPA will see OIDC disabled +
+		// every browser-facing route stays 401.
 		if len(missing) > 0 {
 			return nil, fmt.Errorf("prod mode requires env: %s", strings.Join(missing, ", "))
 		}