feat(admin): add admin settings panel for OIDC configuration

- Admin UI at /admin.html with settings management interface
- REST API: GET/PUT /api/admin/settings/oidc, POST .../test, GET .../general
- DB-backed settings in auth.admin_settings table (PostgreSQL)
- OIDC auto-discovery from issuer URL (.well-known/openid-configuration)
- Hot-reload: OIDC config changes apply without server restart
- Role-based access: admin-only endpoints with 403 for regular users
- Client secret stored securely, never exposed in GET responses
- Env var override detection shown in admin UI
- Clean architecture: repository trait, PG implementation, service, handler

src/interfaces/api/routes.rs

@@ -28,6 +28,7 @@ use crate::interfaces::api::handlers::file_handler::FileHandler;
 use crate::interfaces::api::handlers::i18n_handler::I18nHandler;
 use crate::interfaces::api::handlers::chunked_upload_handler::ChunkedUploadHandler;
 use crate::interfaces::api::handlers::trash_handler;
+use crate::interfaces::api::handlers::admin_handler;
 use crate::interfaces::api::handlers::batch_handler::{
     self, BatchHandlerState
 };
@@ -282,6 +283,11 @@ pub fn create_api_routes(app_state: &AppState) -> Router<AppState> {
     // NOTE: CalDAV and CardDAV routes are mounted at top-level (/caldav, /carddav)
     // in main.rs for protocol compliance, NOT under /api.
 
+    // Admin settings routes (protected by admin_guard inside the handler)
+    let admin_router = admin_handler::admin_routes()
+        .with_state(app_state.clone());
+    router = router.nest("/admin", admin_router);
+
     router
         .layer(CompressionLayer::new())
         .layer(TraceLayer::new_for_http())