feat: add OAuth2/OIDC with PKCE for SSO login

Add opt-in SSO authentication alongside Basic Auth. OAuth endpoints are
auto-discovered via .well-known, with support for external IdPs
(Keycloak, Authentik) via configurable OAUTH_ISSUER_URL. Sessions
persist through httpOnly refresh token cookies with automatic renewal.

app/api/config/route.ts

@@ -18,5 +18,8 @@ export async function GET() {
   return NextResponse.json({
     appName: process.env.APP_NAME || process.env.NEXT_PUBLIC_APP_NAME || 'Webmail',
     jmapServerUrl: process.env.JMAP_SERVER_URL || process.env.NEXT_PUBLIC_JMAP_SERVER_URL || '',
+    oauthEnabled: process.env.OAUTH_ENABLED === 'true',
+    oauthClientId: process.env.OAUTH_CLIENT_ID || '',
+    oauthIssuerUrl: process.env.OAUTH_ISSUER_URL || '',
   });
 }