feat(web): login, first-run setup, org settings; org-aware AuthProvider

- Route group (app) holds AuthProvider + Sidebar, so /login and /setup
  render without app chrome and never mount the provider.
- AuthProvider drops the removed auth_enabled flag and exposes
  {user, org, isAdmin}.
- New login page (password + SSO), first-run setup page, and org settings
  page with a members table and the OIDC provider form.
- Settings page and the Organization nav entry are gated on role, since
  /api/settings now 403s for members.
- GET /api/org/oidc gains client_secret_set so the UI can show whether a
  secret is stored; the secret itself is still never serialized, and an
  empty submitted value still means "keep the stored one".
- Fix logout: the sidebar linked to /auth/logout with a GET, but the route
  is POST-only, so logout was 404ing.

server/internal/api/org.go

@@ -64,10 +64,19 @@ func deleteOrgUser(c *gin.Context) {
 func getOrgOIDC(c *gin.Context) {
 	cfg, err := services.GetOrgOIDC(auth.OrgID(c))
 	if err != nil {
-		c.JSON(http.StatusOK, gin.H{"enabled": false})
+		c.JSON(http.StatusOK, gin.H{"enabled": false, "client_secret_set": false})
 		return
 	}
-	c.JSON(http.StatusOK, cfg)
+	// The client secret itself is write-only (never serialized); expose only
+	// whether one is stored so the UI can say so without leaking it.
+	c.JSON(http.StatusOK, gin.H{
+		"org_id":            cfg.OrgID,
+		"issuer":            cfg.Issuer,
+		"client_id":         cfg.ClientID,
+		"enabled":           cfg.Enabled,
+		"updated_at":        cfg.UpdatedAt,
+		"client_secret_set": cfg.ClientSecretEnc != "",
+	})
 }
 
 func putOrgOIDC(c *gin.Context) {