Fix OIDC: enable from runtime AUTH_OIDC_* (no NEXT_PUBLIC flag) (#5)

The SSO button required NEXT_PUBLIC_AUTH_OIDC_ENABLED, which is baked
at build time and silently fails under Docker runtime env. Drive the
login button from server-side AUTH_OIDC_* instead, and document IdP
redirect URI + AUTH_URL setup.

Co-authored-by: Cursor Agent <[email protected]>

tests/unit/oidc-config.test.ts

@@ -0,0 +1,42 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { isOidcConfigured } from "@/lib/auth/oidc";
+
+describe("isOidcConfigured", () => {
+  const keys = [
+    "AUTH_OIDC_ISSUER",
+    "AUTH_OIDC_CLIENT_ID",
+    "AUTH_OIDC_CLIENT_SECRET",
+  ] as const;
+  const previous: Record<string, string | undefined> = {};
+
+  afterEach(() => {
+    for (const key of keys) {
+      if (previous[key] === undefined) delete process.env[key];
+      else process.env[key] = previous[key];
+    }
+  });
+
+  function save() {
+    for (const key of keys) previous[key] = process.env[key];
+  }
+
+  it("is false when any var is missing", () => {
+    save();
+    delete process.env.AUTH_OIDC_ISSUER;
+    delete process.env.AUTH_OIDC_CLIENT_ID;
+    delete process.env.AUTH_OIDC_CLIENT_SECRET;
+    expect(isOidcConfigured()).toBe(false);
+
+    process.env.AUTH_OIDC_ISSUER = "https://sso.example.com/";
+    process.env.AUTH_OIDC_CLIENT_ID = "id";
+    expect(isOidcConfigured()).toBe(false);
+  });
+
+  it("is true when all three are set", () => {
+    save();
+    process.env.AUTH_OIDC_ISSUER = "https://sso.example.com/";
+    process.env.AUTH_OIDC_CLIENT_ID = "id";
+    process.env.AUTH_OIDC_CLIENT_SECRET = "secret";
+    expect(isOidcConfigured()).toBe(true);
+  });
+});