feat(auth): expose auth_provider in UserDto and guard password ops for OIDC users

- Add auth_provider field to UserDto, derived from oidc_provider
  ("local" for password users, provider name for OIDC users)
- Block change_password() for OIDC users with clear error message
- Block admin_reset_password() for OIDC users

Fixes #122, Fixes #123

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/application/dtos/user_dto.rs

@@ -14,6 +14,7 @@ pub struct UserDto {
     pub updated_at: DateTime<Utc>,
     pub last_login_at: Option<DateTime<Utc>>,
     pub active: bool,
+    pub auth_provider: String,
 }
 
 impl From<User> for UserDto {
@@ -29,6 +30,10 @@ impl From<User> for UserDto {
             updated_at: user.updated_at(),
             last_login_at: user.last_login_at(),
             active: user.is_active(),
+            auth_provider: user
+                .oidc_provider()
+                .unwrap_or("local")
+                .to_string(),
         }
     }
 }