Add optional OIDC authentication via Better Auth genericOAuth plugin

Support self-hosted OIDC providers (Authentik, Authelia, Keycloak, etc.)
configured entirely via environment variables. Uses Better Auth's
hooks.before to gate email/password sign-up at the endpoint level, and
disables emailAndPassword entirely when DISABLE_PASSWORD_LOGIN is set.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.env.example

@@ -1,20 +1,34 @@
+# ─── Database ───────────────────────────────────────────────────────────
 # SQLite database URL (Docker: file:/data/sqlite.db, local dev: file:sqlite.db)
-DATABASE_URL=file:./data/sqlite.db
+# DATABASE_URL=file:/data/sqlite.db
 
-# TMDB API Read Access Token — get one at https://www.themoviedb.org/settings/api
+# ─── TMDB (required) ───────────────────────────────────────────────────────
+# API Read Access Token — get one at https://www.themoviedb.org/settings/api
 TMDB_API_READ_ACCESS_TOKEN=your_tmdb_api_read_access_token_here
 
-# Random secret for session encryption (min 32 chars)
-BETTER_AUTH_SECRET=your_secret_here
-
-# Public URL of your instance
-BETTER_AUTH_URL=http://localhost:3000
-
 # Optional: override TMDB base URLs (advanced)
 # TMDB_API_BASE_URL=https://api.themoviedb.org/3
 # TMDB_IMAGE_BASE_URL=https://image.tmdb.org/t/p
 
-# Image caching — downloads TMDB images to local disk for faster serving
-# Set to "false" to disable and use TMDB CDN directly (default: enabled)
-IMAGE_CACHE_DIR=./data/images
-# IMAGE_CACHE_ENABLED=false
+# ─── Auth (required) ───────────────────────────────────────────────────────
+# Random secret for session encryption (min 32 chars)
+# Generate one with `npx @better-auth/cli secret` or `openssl rand -base64 32`
+BETTER_AUTH_SECRET=your_secret_here
+# Public URL of your instance, especially important if reverse proxy is used
+BETTER_AUTH_URL=http://localhost:3000
+
+# ─── OIDC Authentication (optional) ────────────────────────────────────
+# OIDC is enabled when OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, and OIDC_ISSUER_URL are all set.
+# Callback URL to configure in your IdP: ${BETTER_AUTH_URL}/api/auth/oauth2/callback/oidc
+# OIDC_CLIENT_ID=
+# OIDC_CLIENT_SECRET=
+# OIDC_ISSUER_URL=              # e.g. https://authentik.example.com/application/o/sofa
+# OIDC_PROVIDER_NAME=SSO        # Display name on login button (default: "SSO")
+# OIDC_AUTO_REGISTER=true       # Auto-create users on first OIDC login (default: true)
+# DISABLE_PASSWORD_LOGIN=false  # Set to "true" to hide email/password form when OIDC is configured
+
+# ─── Image Caching ─────────────────────────────────────────────────────
+# Downloads TMDB images to local disk for faster serving (default: /data/images)
+# IMAGE_CACHE_DIR=/data/images
+# Set IMAGE_CACHE_ENABLED to "false" to use TMDB CDN directly (default: enabled)
+# IMAGE_CACHE_ENABLED=true