Add optional OIDC authentication via Better Auth genericOAuth plugin

Support self-hosted OIDC providers (Authentik, Authelia, Keycloak, etc.)
configured entirely via environment variables. Uses Better Auth's
hooks.before to gate email/password sign-up at the endpoint level, and
disables emailAndPassword entirely when DISABLE_PASSWORD_LOGIN is set.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/api/registration/status/route.ts

@@ -1,7 +1,16 @@
 import { NextResponse } from "next/server";
+import {
+  getOidcProviderName,
+  isOidcConfigured,
+  isPasswordLoginDisabled,
+} from "@/lib/config";
 import { isRegistrationOpen } from "@/lib/services/settings";
 
 export async function GET() {
-  const registrationOpen = await isRegistrationOpen();
-  return NextResponse.json({ registrationOpen });
+  return NextResponse.json({
+    registrationOpen: await isRegistrationOpen(),
+    oidcEnabled: isOidcConfigured(),
+    oidcProviderName: isOidcConfigured() ? getOidcProviderName() : null,
+    passwordLoginDisabled: isPasswordLoginDisabled(),
+  });
 }