Move OIDC Token Handling from Client-Side to Server-Side (BFF Pattern)

## Context

DiracX-Web handles OIDC authentication entirely client-side using `@axa-fr/react-oidc`, which isolates tokens via a Service Worker. This works but has drawbacks:

- **~3,000 lines of auth code** in the frontend (`OidcServiceWorker.js`, providers, token handling)
- Service Worker token isolation is [explicitly discouraged by the OAuth RFC for browser-based apps](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps) (Section 7.4)
- Tokens are visible in the browser Network tab despite SW isolation
- Static trusted domains file requires rebuild to change

## Proposal

Replace the client-side OIDC flow with [`oauth2-proxy`](https://github.com/oauth2-proxy/oauth2-proxy) (CNCF Sandbox project) acting as a Backend-for-Frontend (BFF) — the [recommended pattern](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps) (Section 6.1) for browser-based apps.

- **Browser users**: oauth2-proxy handles OIDC, stores tokens server-side, browser only sees httpOnly cookies. The SPA makes plain `fetch()` calls with no token handling.
- **CLI / scripts**: unchanged — they use Bearer tokens directly via `/api`, bypassing oauth2-proxy entirely.

## Caveats

- Adds an infrastructure component (oauth2-proxy) — the current approach needs only static hosting. This is a concern for non-Kubernetes sites.
- Dynamic scope selection (VO/group) via `loginURLParameters` requires oauth2-proxy's alpha config format.

## Definition of Done

- [ ] Proof of concept: verify oauth2-proxy correctly forwards dynamic scopes to DiracX's `/authorize` endpoint
- [ ] Integrate oauth2-proxy in diracx-charts (subchart + ingress routing)
- [ ] Remove client-side OIDC code (`@axa-fr/react-oidc`, Service Worker, token handling)
- [ ] OIDC flow works end-to-end (login, logout, token refresh, VO/group selection)
- [ ] CLI/script access unaffected
- [ ] Define deployment model for non-Kubernetes sites

Thanks @ryuwd for the initial suggestion and investigation in LHCb context!