Publish Docker image to GHCR on main builds

Add a Docker workflow that builds on PRs and pushes to
ghcr.io/chewbaccalakis/rfid-database on main (latest + sha) and v* tags.
Drop the redundant docker-build job from CI.

src/app/login/page.tsx

@@ -6,10 +6,16 @@ import { LoginPageClient } from "@/components/LoginPageClient";
 export const dynamic = "force-dynamic";
 
 export default function LoginPage() {
+  const authUrl = (process.env.AUTH_URL || "").replace(/\/$/, "");
+  const callbackUrlHint = authUrl
+    ? `${authUrl}/api/auth/callback/oidc`
+    : "https://<your-host>/api/auth/callback/oidc";
+
   return (
     <LoginPageClient
       oidcEnabled={isOidcConfigured()}
       oidcName={process.env.AUTH_OIDC_NAME || "SSO"}
+      callbackUrlHint={callbackUrlHint}
     />
   );
 }

src/components/LoginPageClient.tsx

@@ -8,11 +8,13 @@ import { Suspense } from "react";
 type Props = {
   oidcEnabled: boolean;
   oidcName: string;
+  callbackUrlHint: string;
 };
 
 type AuthConfig = {
   oidcEnabled: boolean;
   oidcName: string;
+  callbackUrl: string;
 };
 
 function authErrorMessage(code: string | null): string | null {
@@ -34,7 +36,7 @@ function authErrorMessage(code: string | null): string | null {
   }
 }
 
-function LoginForm({ oidcEnabled, oidcName }: Props) {
+function LoginForm({ oidcEnabled, oidcName, callbackUrlHint }: Props) {
   const router = useRouter();
   const params = useSearchParams();
   const callbackUrl = params.get("callbackUrl") || "/";
@@ -60,6 +62,7 @@ function LoginForm({ oidcEnabled, oidcName }: Props) {
 
   const showOidc = runtimeOidc?.oidcEnabled ?? oidcEnabled;
   const displayName = runtimeOidc?.oidcName || oidcName;
+  const redirectHint = runtimeOidc?.callbackUrl || callbackUrlHint;
 
   async function onSubmit(e: FormEvent) {
     e.preventDefault();
@@ -118,13 +121,20 @@ function LoginForm({ oidcEnabled, oidcName }: Props) {
           {loading ? "Signing in…" : "Sign in"}
         </button>
         {showOidc && (
-          <button
-            type="button"
-            className="btn btn-secondary"
-            onClick={() => signIn("oidc", { callbackUrl })}
-          >
-            Sign in with {displayName}
-          </button>
+          <>
+            <button
+              type="button"
+              className="btn btn-secondary"
+              onClick={() => signIn("oidc", { callbackUrl })}
+            >
+              Sign in with {displayName}
+            </button>
+            <p className="muted" style={{ margin: 0, fontSize: "0.75rem" }}>
+              IdP redirect URI must be exactly:
+              <br />
+              <code className="mono">{redirectHint}</code>
+            </p>
+          </>
         )}
       </form>
     </div>

src/lib/auth/auth.ts

@@ -45,8 +45,6 @@ function buildProviders(): Provider[] {
       wellKnown: `${issuer}/.well-known/openid-configuration`,
       clientId: process.env.AUTH_OIDC_CLIENT_ID!,
       clientSecret: process.env.AUTH_OIDC_CLIENT_SECRET!,
-      // Auth.js OIDC defaults to PKCE-only; Authelia requires a strong `state`
-      checks: ["pkce", "state"],
       authorization: {
         params: {
           scope: "openid email profile",