feat(server): OIDC 登录支持（F23）

- 引入 openid-client，新增 /api/auth/oidc/login + /api/auth/oidc/callback
- 通过 email 绑定既有员工账号，保留密码登录 fallback
- OIDC 状态存 cookie(HMAC) + PKCE + SameSite=lax 防 CSRF
- 更新 env/README 与 v3 CSV 状态推进

server/src/config.js

@@ -49,6 +49,13 @@ function getConfig() {
     loginFailMaxAttempts: Number(process.env.AUTH_LOGIN_FAIL_MAX_ATTEMPTS ?? 5),
     loginLockSeconds: Number(process.env.AUTH_LOGIN_LOCK_SECONDS ?? 30 * ONE_MINUTE_SECONDS),
 
+    oidcEnabled: process.env.OIDC_ENABLED === "true",
+    oidcIssuerUrl: process.env.OIDC_ISSUER_URL ?? "",
+    oidcClientId: process.env.OIDC_CLIENT_ID ?? "",
+    oidcClientSecret: process.env.OIDC_CLIENT_SECRET ?? "",
+    oidcRedirectUri: process.env.OIDC_REDIRECT_URI ?? "",
+    oidcScopes: process.env.OIDC_SCOPES ?? "openid profile email",
+
     appTimezone: process.env.APP_TIMEZONE ?? "Asia/Shanghai",
     storageDir: path.resolve(serverRoot, storageDir),
     storageDriver: process.env.STORAGE_DRIVER ?? "local",