Add /auth/login and /auth/callback handlers. The backend holds the
client secret and exchanges the authorization code server-side;
the browser never sees the secret. Redirect URI and post-login
fragment destination are derived solely from GATEWAY_SERVER_PUBLIC_URL
(required when OIDC is set) to prevent host-header injection.
main.go connects all packages: config → pool → migrate → cipher → store
→ providermgr → catalog → optional OIDC → rate limiter → API server.
WriteTimeout is zero to support SSE streaming; no middleware.Timeout.
Config validation now allows OIDC to be optional (static-token fallback).
