feat(oidc): add auto-redirect for OIDC

add `auto_redirect_if_standalone_oidc` in `OXICLOUD_AUTH_POLICIES`
let admin decide to redirect immediately to IdP if OIDC is the only auth method enabled

example.env

@@ -805,8 +805,21 @@ OXICLOUD_WOPI_ENABLED=false
 #     policy — the IdP is the security boundary and may enforce MFA we
 #     shouldn't bypass.
 #
+#   auto_redirect_if_standalone_oidc
+#     When OIDC is the ONLY working login method (no password, no
+#     magic-link, whether via the allowlist or the OIDC-master rule),
+#     the login SPA auto-redirects to the OIDC authorize endpoint on
+#     page load instead of showing a click-to-continue SSO button.
+#     Off by default because auto-redirect can loop on IdP failure
+#     (login → IdP error → back to login → auto-redirect again) and
+#     makes logout-then-visit-login flows feel broken (bounces the
+#     user right back into the app). Silent no-op when the login page
+#     has more than one method available (nothing to auto-choose).
+#
 # Example:
 #OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users
+#OXICLOUD_AUTH_POLICIES=auto_redirect_if_standalone_oidc
+#OXICLOUD_AUTH_POLICIES=permit_magic_link_for_password_users,auto_redirect_if_standalone_oidc
 
 
 # Operator-level kill switch for share-notification emails to internal