feat(server): OIDC 登录支持（F23）

- 引入 openid-client，新增 /api/auth/oidc/login + /api/auth/oidc/callback
- 通过 email 绑定既有员工账号，保留密码登录 fallback
- OIDC 状态存 cookie(HMAC) + PKCE + SameSite=lax 防 CSRF
- 更新 env/README 与 v3 CSV 状态推进

server/package.json

@@ -42,6 +42,7 @@
     "fastify-plugin": "^5.1.0",
     "nodemailer": "^6.10.1",
     "node-cron": "^4.2.1",
+    "openid-client": "^6.8.2",
     "prom-client": "^15.1.0",
     "pg-boss": "^10.3.0",
     "pg": "^8.18.0",