Login initiation + OIDC callback (PKCE exchange)

Status: ✅ Done.

Implemented the redirect-based Authorization Code + PKCE flow using oidc-client-ts.

• oidcLogin() calls signinRedirect() to begin the flow — the only action that redirects to the identity provider.
• The callback is handled automatically on return to the site root (the redirect URI is the root, per #157): the code/state are processed client-side by signinRedirectCallback() and then stripped from the URL. No dedicated callback route or page is required, so the earlier "callback route" acceptance criterion is dropped.
• The entire flow stays client-side; the code/state never reach the origin (and the worker strips query strings from cache keys regardless).

The issue names oidcLogin(), signinRedirect(), signinRedirectCallback(), and the site root as the flow entry points. Review those references to verify the stated client-side redirect and callback behavior; the issue reports the work as done, so it does not define a remaining change or completion test.