feat(auth): add OIDC multi-user mode

[saltbo]

Summary

This adds an optional, lightweight multi-user mode backed by an external OpenID Connect provider. Sink does not add local user registration or user-management screens.

• implement Authorization Code flow with PKCE, state, nonce, issuer discovery, validated ID tokens, and encrypted server-owned sessions
• make authentication modes exclusive:
  • no OIDC configuration: preserve the existing single-user mode with the shared root owner
  • complete OIDC configuration: require OIDC sessions and disable site-token and Cloudflare Access authentication for protected APIs
  • partial OIDC configuration: fail closed instead of silently falling back
• isolate D1 links, tags, and analytics by the stable OIDC subject
• keep existing records assigned to root, with an explicit owner-alias option for identity transitions
• add an administrator email allowlist for site-wide migration and backup operations
• sign out only from Sink's local session, leaving the shared identity-provider session intact
• keep translated login copy across all existing locales

Related to #104.

Why

The existing discussions around multi-user support point toward external identity rather than building a local user-management system. This keeps the scope focused on small-team deployments while preserving the current single-user behavior for existing installations.

Authentication modes

OIDC mode is selected only when the issuer, client ID, client secret, and session secret are all configured. The modes never run side by side.

Existing single-user deployments require no migration beyond the included D1 schema migration, which assigns existing links to the root owner.

Validation

• pnpm exec vitest run: 32 files, 304 tests passed
• pnpm types:check
• pnpm locales:check: 11 locales, 8 modules
• pnpm build
• ESLint passed for every file changed by this PR

A full pnpm lint also scans two unchanged Pages deployment documents from the current base branch and reports their existing formatting errors. This PR deliberately leaves those unrelated files untouched.