fix: fetch OIDC discovery before building authorization URL (#91)

get_authorize_url() was synchronous and fell back to constructing
{issuer}/authorize when the discovery cache was empty. This produced
incorrect URLs for providers like Keycloak whose authorization
endpoint is {issuer}/protocol/openid-connect/auth.

Made get_authorize_url() async so it can call get_discovery() to
fetch the real authorization_endpoint from .well-known/openid-configuration
before the first redirect. The discovery document is cached after the
initial fetch.

src/interfaces/api/handlers/auth_handler.rs

@@ -334,7 +334,7 @@ async fn oidc_authorize(
     }
 
     // Prepare OIDC authorization flow (generates CSRF state, PKCE pair, nonce)
-    let authorize_url = auth_app.prepare_oidc_authorize()?;
+    let authorize_url = auth_app.prepare_oidc_authorize().await?;
 
     tracing::info!("OIDC authorize redirect generated");