feat(admin): add admin settings panel for OIDC configuration

- Admin UI at /admin.html with settings management interface
- REST API: GET/PUT /api/admin/settings/oidc, POST .../test, GET .../general
- DB-backed settings in auth.admin_settings table (PostgreSQL)
- OIDC auto-discovery from issuer URL (.well-known/openid-configuration)
- Hot-reload: OIDC config changes apply without server restart
- Role-based access: admin-only endpoints with 403 for regular users
- Client secret stored securely, never exposed in GET responses
- Env var override detection shown in admin UI
- Clean architecture: repository trait, PG implementation, service, handler

src/application/dtos/settings_dto.rs

@@ -0,0 +1,58 @@
+use serde::{Serialize, Deserialize};
+
+// ============================================================================
+// OIDC Settings DTOs (Admin Panel)
+// ============================================================================
+
+/// Current OIDC settings returned to admin UI (secrets masked)
+#[derive(Debug, Serialize, Deserialize)]
+pub struct OidcSettingsDto {
+    pub enabled: bool,
+    pub issuer_url: String,
+    pub client_id: String,
+    /// True if a client secret is configured (never reveals the actual value)
+    pub client_secret_set: bool,
+    pub scopes: String,
+    pub auto_provision: bool,
+    pub admin_groups: String,
+    pub disable_password_login: bool,
+    pub provider_name: String,
+    /// Auto-generated callback URL the admin must register in their IdP
+    pub callback_url: String,
+    /// Field names overridden by environment variables (read-only in UI)
+    pub env_overrides: Vec<String>,
+}
+
+/// Request body for saving OIDC settings from the admin panel
+#[derive(Debug, Serialize, Deserialize)]
+pub struct SaveOidcSettingsDto {
+    pub enabled: bool,
+    pub issuer_url: String,
+    pub client_id: String,
+    /// Only update if provided and non-empty (None = keep existing)
+    pub client_secret: Option<String>,
+    pub scopes: Option<String>,
+    pub auto_provision: Option<bool>,
+    pub admin_groups: Option<String>,
+    pub disable_password_login: Option<bool>,
+    pub provider_name: Option<String>,
+}
+
+/// Request body for testing OIDC discovery
+#[derive(Debug, Serialize, Deserialize)]
+pub struct TestOidcConnectionDto {
+    pub issuer_url: String,
+}
+
+/// Result of OIDC connection test
+#[derive(Debug, Serialize, Deserialize)]
+pub struct OidcTestResultDto {
+    pub success: bool,
+    pub message: String,
+    pub issuer: Option<String>,
+    pub authorization_endpoint: Option<String>,
+    pub token_endpoint: Option<String>,
+    pub userinfo_endpoint: Option<String>,
+    /// Suggested provider name (derived from issuer hostname)
+    pub provider_name_suggestion: Option<String>,
+}