feat(phase2): OAuth/Authentik integration + drag-and-drop reordering

- Add OIDC/OAuth2 login via openid-client with PKCE flow
- Auto-provision OAuth users with group mapping
- Conditional login page (OAuth/local/both based on auth mode)
- Admin OAuth test connection button
- Install svelte-dnd-action for board editor DnD
- Draggable sections and widgets with cross-section moves
- Reorder APIs with atomic Prisma transactions
- Visual drag handles and drop zone indicators

.env.example

@@ -11,6 +11,12 @@ APP_PORT=3000
 APP_HOST="0.0.0.0"
 APP_URL="http://localhost:3000"
 
+# OAuth / OIDC (optional — configure here or in Admin > Settings)
+OAUTH_CLIENT_ID=""
+OAUTH_CLIENT_SECRET=""
+OAUTH_DISCOVERY_URL=""
+OAUTH_REDIRECT_URI=""
+
 # Guest mode (true = allow unauthenticated dashboard access)
 GUEST_MODE="true"