ExternalAuth: a generic OpenID Connect provider configured by issuer URL

ExternalAuth has one hand-written provider per vendor (Google, GitHub, Facebook, LinkedIn), each with its own start and callback endpoints and its own hard-coded URLs. Every new identity provider is another pair of endpoints.

Add one generic OpenID Connect provider configured by issuer URL, so Cognito, Firebase Auth, Microsoft Entra ID, Auth0, Keycloak and any other standard OIDC provider work without new code.

## Proposal

- Config: `Oidc:Providers:{name}:Authority`, `ClientId`, `ClientSecret`, optional `DisplayName` and `Scopes` (default `openid email profile`). More than one provider can be configured.
- Routes: `GET /api/auth/oidc/{name}/start` and `GET /api/auth/oidc/{name}/callback`, following the Google endpoints for state and club cookies.
- Endpoints come from the issuer's `/.well-known/openid-configuration`, cached, not typed into config.
- Validate the ID token (issuer, audience, signature against the issuer's JWKS, expiry, nonce) instead of only calling userinfo.
- Hand off to `SocialSignIn.IssueAsync` with `emailVerified` taken from the `email_verified` claim. Absent or false is refused, same as Google and LinkedIn today.
- `GET /api/auth/providers` lists the configured OIDC providers by name and display name. Adding that field is not a breaking change.

The Google provider already speaks OIDC. Moving it onto this path can come later and is not part of this issue.

## Done when

- A test against a stub OIDC issuer signs a person in and gets the same tenant-scoped, device-bound token the Google flow issues.
- An ID token with the wrong audience, a bad signature or `email_verified` false is refused.
- The README's verification table gains a row for OIDC.

Start by tracing the existing Google start and callback endpoints, including their state and club cookies, then inspect SocialSignIn.IssueAsync and GET /api/auth/providers. Add coverage using a stub OIDC issuer for successful sign-in and rejection of invalid audience, signature, or email_verified. Update the README verification table with an OIDC row.

Written by the indexing model from the issue text.