fix: dedupe IdP auto-redirect and fix CSP/bfcache bug on the SPA shell

- Extract tryAutoRedirectToIdp() on the login page so onMount's redirect
  guard and the post-setup flow share one check instead of drifting.
- Fix a real bug: 304 Not Modified responses carry no Content-Type, so
  is_html misclassified them and attached the strict headerless CSP,
  which browsers merge into the cached 200's effective headers and
  defeat the SPA's hash-based CSP on revalidated repeat visits.
- Add Cache-Control: no-store on the SPA shell to opt out of bfcache,
  preventing a pre-deploy shell (stale inline hydration script + CSP
  hash) from being resurrected byte-for-byte across the OIDC redirect's
  full-page navigations.
- Add a manual, human-run SSO-only script/env (ports 8090/1081) since
  the automated oidc.hurl suite keeps password login enabled and never
  exercises the auto-redirect guard.

tests/common/server-with-oidc-only.env

@@ -0,0 +1,79 @@
+# OxiCloud test-server env file for the MANUAL SSO-only auto-redirect test.
+#
+# Layered on top of server-with-oidc.env: identical EXCEPT
+# OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true, which makes OIDC the ONLY
+# login method (magic-link is already hard-disabled whenever OIDC is
+# enabled, per the "OIDC master rule" — see example.env). This is the
+# config the frontend's login-page auto-redirect guard
+# (frontend/src/routes/login/+page.svelte) actually fires under —
+# tests/common/server-with-oidc.env keeps password login on, so the
+# automated tests/oidc/oidc.hurl suite never exercises the redirect.
+#
+# Used by tests/oidc/run-manual-sso-only.sh (human-run, not CI). Distinct
+# ports (8090 / IdP 1081) so it doesn't collide with a concurrently running
+# `just api-test` (which uses 8087 / IdP 1080) or a local `cargo run` dev
+# server.
+#
+# `--config` makes the binary read THIS file verbatim — there is no
+# auto-merge with server.env, so every variable the server needs has
+# to be repeated here (same rationale as server-with-oidc.env).
+
+# ── Shared test config (mirrors server.env) ────────────────────────────────
+DATABASE_URL=postgres://oxicloud_test:oxicloud_test@localhost:5433/oxicloud_test
+OXICLOUD_DB_CONNECTION_STRING=postgres://oxicloud_test:oxicloud_test@localhost:5433/oxicloud_test
+OXICLOUD_STATIC_PATH=./static
+OXICLOUD_JWT_SECRET=test-secret-do-not-use-in-prod-minimum-32-chars
+OXICLOUD_ENABLE_AUTH=true
+OXICLOUD_ENABLE_TRASH=true
+OXICLOUD_ENABLE_SEARCH=true
+OXICLOUD_ENABLE_FILE_SHARING=true
+OXICLOUD_ENABLE_MUSIC=true
+OXICLOUD_EXPOSE_SYSTEM_USERS=true
+OXICLOUD_WOPI_ENABLED=false
+OXICLOUD_NEXTCLOUD_ENABLED=true
+OXICLOUD_ENABLE_ADMIN_INTERNAL_ENDPOINTS=true
+
+RUST_LOG="warn,audit=info,oxicloud::infrastructure::services::oidc_service=info,oxicloud::application::services::auth_application_service=info"
+
+OXICLOUD_RATE_LIMIT_REFRESH_MAX=3600
+OXICLOUD_RATE_LIMIT_LOGIN_MAX=3600
+OXICLOUD_RATE_LIMIT_REGISTER_MAX=3600
+OXICLOUD_TRUST_PROXY_CIDR=0.0.0.0/0
+
+# Mock SMTP — kept wired even though magic-link login is disabled under the
+# OIDC master rule, so the invite/mail transport doesn't 503 unconfigured.
+OXICLOUD_SMTP_MOCK=true
+OXICLOUD_SMTP_HOST=localhost
+OXICLOUD_SMTP_PORT=25
+OXICLOUD_SMTP_FROM='OxiCloud Tests <test@oxicloud.local>'
+OXICLOUD_SMTP_TLS=none
+OXICLOUD_ALLOW_EXTERNAL_USERS=true
+
+# ── OIDC client wired at the fake-idp sidecar (SSO-only) ───────────────────
+# tests/oidc/fake_idp/server.js (panva/node-oidc-provider) publishes the
+# issuer at the root URL; discovery is at /.well-known/openid-configuration
+# under it. Update the `clients[0].client_id` field there in tandem if you
+# rename the client.
+OXICLOUD_OIDC_ENABLED=true
+OXICLOUD_OIDC_ISSUER_URL=http://localhost:1081
+OXICLOUD_OIDC_CLIENT_ID=oxicloud-test
+OXICLOUD_OIDC_CLIENT_SECRET=test-client-secret-not-used-in-prod
+# The IdP redirects back to this exact URL after auto-approving; must
+# match the OxiCloud server's actual host + port.
+OXICLOUD_OIDC_REDIRECT_URI=http://localhost:8090/api/auth/oidc/callback
+OXICLOUD_OIDC_SCOPES="openid profile email"
+# Frontend redirect target after a successful callback. The backend
+# appends `/login?oidc_code=…` to this base, so the value here is the
+# SPA origin only.
+OXICLOUD_OIDC_FRONTEND_URL=http://localhost:8090
+OXICLOUD_OIDC_AUTO_PROVISION=true
+OXICLOUD_OIDC_PROVIDER_NAME=MockSSO-Only
+# Group-to-role mapping — same fake-idp claim shape as server-with-oidc.env.
+OXICLOUD_OIDC_ADMIN_GROUPS=admin-users
+
+# The single flag that makes OIDC the ONLY login method: is_password_login_allowed()
+# is exactly `!disable_password_login` (auth_application_service.rs). Magic-link
+# is already hard-disabled whenever OIDC is enabled, regardless of AUTH_METHODS.
+OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=true
+
+OXICLOUD_REQUIRE_VERIFIED_EMAIL=false