Fix OIDC enablement: detect config at runtime, drop NEXT_PUBLIC flag

The SSO button required NEXT_PUBLIC_AUTH_OIDC_ENABLED, which is baked
at build time and silently fails under Docker runtime env. Drive the
login button from server-side AUTH_OIDC_* instead, and document IdP
redirect URI + AUTH_URL setup.

docker-compose.yml

@@ -16,15 +16,12 @@ services:
       PORT: "3000"
       HOSTNAME: 0.0.0.0
       AUTH_TRUST_HOST: "true"
+      # OIDC: set AUTH_OIDC_ISSUER / CLIENT_ID / CLIENT_SECRET (and AUTH_URL)
+      # in .env — the login page picks them up at runtime.
       # Optional bootstrap (only creates if missing):
       # CREATE_USER_EMAIL: [email protected]
       # CREATE_USER_PASSWORD: change-me
       # CREATE_USER_NAME: Admin
-      # Optional OIDC — also set NEXT_PUBLIC_* in .env if using SSO button
-      # AUTH_OIDC_ISSUER: ${AUTH_OIDC_ISSUER:-}
-      # AUTH_OIDC_CLIENT_ID: ${AUTH_OIDC_CLIENT_ID:-}
-      # AUTH_OIDC_CLIENT_SECRET: ${AUTH_OIDC_CLIENT_SECRET:-}
-      # AUTH_OIDC_NAME: ${AUTH_OIDC_NAME:-SSO}
     volumes:
       - rfid-data:/data
     healthcheck: