Add OIDC SSO and two-factor enforcement

[jusso-dev]

Problem

Larger teams need centralized login and stronger account security for an incident-management tool.

Scope

• Add OIDC login configuration for common providers.
• Map OIDC identities to users and organizations.
• Add optional two-factor enforcement for local accounts if local auth exists.
• Add session management and logout behavior as needed for the dashboard/API UI.

Acceptance criteria

• Admins can configure an OIDC provider through environment or API settings.
• Users can sign in with OIDC and land in the correct organization.
• Org admins can require stronger auth policy.
• Auth events are written to audit logs.
• Tests cover callback validation and role mapping hooks.

Dependencies

• Organizations, teams, and RBAC.

Notes

This issue is part of the GoUpTime product roadmap.