Enable ORCID Sandbox for development servers

Currently, the ORCID OIDC provider is hard-coded to use the production environment `https://orcid.org`. For development and testing, it should be possible to use the ORCID sandbox `https://sandbox.orcid.org` instead. This would allow developers to test authentication with (multiple) sandbox accounts without using real ORCID accounts or production credentials.

I propose enabling the use of the ORCID sandbox through an additional environment variable such as `ORCID_USE_SANDBOX=1`, while keeping the production instance as the default. Alternatively, the use of the sandbox could be triggered by setting `DEV_MODE=1`, but this would make it impossible to use `DEV_MODE=1` with the production ORCID server.

Locate the ORCID OIDC provider configuration and the hard-coded https://orcid.org value, then inspect how environment variables are read. Add a development opt-in for https://sandbox.orcid.org while preserving production as the default, and verify authentication with sandbox accounts plus the unchanged production configuration.

Written by the indexing model from the issue text.