feat(auth): add generic OIDC login with mandatory groups

backend/test/auth-routes-local.test.ts

@@ -500,7 +500,7 @@ test("operational config failures return 503 and never consume login-failure cap
   expect((await login(app, { password: `${password}!` })).statusCode).toBe(429);
 });
 
-test("public auth configuration is safe and OIDC protocol placeholders fail closed", async () => {
+test("public auth configuration is safe and unavailable OIDC login fails closed", async () => {
   const { app } = await createLocalApp();
   const configuration = await app.inject({ method: "GET", url: "/auth/config" });
   expect(configuration.statusCode).toBe(200);
@@ -508,6 +508,6 @@ test("public auth configuration is safe and OIDC protocol placeholders fail clos
   expect(JSON.stringify(configuration.json())).not.toContain("users.yaml");
 
   const placeholder = await app.inject({ method: "GET", url: "/auth/oidc/login" });
-  expect(placeholder.statusCode).toBe(501);
-  expect(placeholder.json()).toEqual({ code: "auth_not_implemented", error: "OIDC login is not implemented" });
+  expect(placeholder.statusCode).toBe(503);
+  expect(placeholder.json()).toEqual({ code: "auth_unavailable", error: "Authentication is unavailable" });
 });