feat(oidc): add auto-redirect for OIDC

add `auto_redirect_if_standalone_oidc` in `OXICLOUD_AUTH_POLICIES`
let admin decide to redirect immediately to IdP if OIDC is the only auth method enabled

frontend/src/lib/styles/ported/auth.css

@@ -212,18 +212,17 @@
     margin-top: var(--space-5);
 }
 
-/* SSO / OIDC button */
+/* SSO / OIDC button — inherits the primary .auth-button visual
+   (accent gradient + on-accent text), only overriding layout so an
+   optional provider icon can sit beside the label. The previous
+   text-color gradient was unreadable in dark mode because the
+   inherited text color also resolved to a light value. */
 .auth-button-oidc {
-    background: linear-gradient(135deg, var(--color-text) 0%, var(--color-text-secondary) 100%);
-    box-shadow: 0 4px 12px var(--color-shadow-3xl);
     display: flex;
     align-items: center;
     justify-content: center;
     gap: var(--space-2-5);
-}
-
-.auth-button-oidc:hover {
-    box-shadow: 0 6px 20px var(--color-shadow-4xl);
+    text-decoration: none;
 }
 
 .auth-button-sso {

frontend/src/routes/login/+page.svelte

@@ -249,19 +249,6 @@
 		}
 	}
 
-	// Shared by onMount step 4 and onSetup: true + navigates away iff OIDC is
-	// the only login method. Centralised so the guard can't drift between the
-	// two call sites (only the `?error=` loop-guard, checked at onMount time,
-	// doesn't apply post-setup — a freshly created admin can't have bounced
-	// off the IdP yet).
-	function tryAutoRedirectToIdp(): boolean {
-		if (oidc.enabled && oidc.password_login_enabled === false && oidc.authorize_endpoint) {
-			window.location.replace(oidc.authorize_endpoint);
-			return true;
-		}
-		return false;
-	}
-
 	async function onSetup(e: SubmitEvent) {
 		e.preventDefault();
 		setupError = '';
@@ -276,10 +263,6 @@
 			setupEmail = setupPassword = setupConfirm = '';
 			// Admin now exists — fold the setup affordance away and return to login.
 			setupAvailable = false;
-			// OIDC-only: the login page would immediately redirect on the next
-			// visit anyway — skip the "you can now sign in" detour and forward
-			// straight to the IdP instead of leaving a dead-end local form.
-			if (tryAutoRedirectToIdp()) return;
 			setupSuccess = t('auth.admin_success', 'Administrator created. You can now sign in.');
 			setTimeout(() => {
 				mode = 'login';
@@ -340,12 +323,11 @@
 		setupAvailable = !status.initialized;
 		if (setupAvailable) mode = 'setup';
 
-		// 4) Auto-redirect: when OIDC is the only auth method, skip the login page.
-		//    Guard against loops: if the IdP returned ?error=, fall through to the UI.
-		if (!setupAvailable && !page.url.searchParams.has('error') && tryAutoRedirectToIdp()) {
-			return;
-		}
-
+		// Auto-redirect to the IdP in standalone-OIDC posture is enforced
+		// server-side via the `auto_redirect_if_standalone_oidc` auth policy
+		// (see interfaces/web/mod.rs::oidc_standalone_login_redirect). Keeping
+		// a client-side copy would make the policy toggle a no-op — the SPA
+		// would auto-redirect regardless of what the admin configured.
 		booting = false;
 	});