feat: add OAuth2/OIDC with PKCE for SSO login

Add opt-in SSO authentication alongside Basic Auth. OAuth endpoints are
auto-discovered via .well-known, with support for external IdPs
(Keycloak, Authentik) via configurable OAUTH_ISSUER_URL. Sessions
persist through httpOnly refresh token cookies with automatic renewal.

lib/jmap/client.ts

@@ -161,14 +161,15 @@ export class JMAPClient {
     const sessionUrl = `${this.serverUrl}/.well-known/jmap`;
 
     try {
-      const sessionResponse = await fetch(sessionUrl, {
+      const sessionResponse = await this.authenticatedFetch(sessionUrl, {
         method: 'GET',
-        headers: { 'Authorization': this.authHeader },
       });
 
       if (!sessionResponse.ok) {
         if (sessionResponse.status === 401) {
-          throw new Error('Invalid username or password');
+          throw new Error(this.authMode === 'bearer'
+            ? 'Authentication failed - token may be expired'
+            : 'Invalid username or password');
         }
         throw new Error(`Failed to get session: ${sessionResponse.status}`);
       }