feat(phase2): OAuth/Authentik integration + drag-and-drop reordering

- Add OIDC/OAuth2 login via openid-client with PKCE flow
- Auto-provision OAuth users with group mapping
- Conditional login page (OAuth/local/both based on auth mode)
- Admin OAuth test connection button
- Install svelte-dnd-action for board editor DnD
- Draggable sections and widgets with cross-section moves
- Reorder APIs with atomic Prisma transactions
- Visual drag handles and drop zone indicators

plans/phase-2-enhanced-features/CONTEXT.md

@@ -1,8 +1,11 @@
 # Feature Context: Phase 2 — Enhanced Features
 
 ## Current State
-MVP is complete and merged to master. All build/test/lint passes. 151 files, 115 tests.
-Starting Phase 2 enhanced features on a new feature branch.
+
+Phase 1 (OAuth/Authentik Integration) and Phase 2 (DnD) are complete.
+Installed `openid-client` v6.8.2. OAuth login flow uses PKCE and issues local JWT tokens.
+Login page conditionally shows OAuth button and/or local form based on `authMode` SystemSettings.
+Admin settings page has a working "Test Connection" button for OAuth configuration.
 
 ## Temporary Workarounds
 - None yet
@@ -15,7 +18,16 @@ Starting Phase 2 enhanced features on a new feature branch.
 - Phase 5 (Integration) depends on all prior phases
 
 ## Implementation Notes
-- Big Bang strategy: intermediate phases may not build. Phase 5 is the convergence phase.
+- Big Bang strategy: intermediate phases may not build. Phase 6 is the convergence phase.
 - OAuth uses `openid-client` (already installed in MVP dependencies)
-- DnD uses `svelte-dnd-action` (needs to be installed)
+- DnD uses `svelte-dnd-action` (installed in Phase 2)
 - New widget types extend the existing Widget model's `type` and `config` JSON fields
+
+## Phase 2 (DnD) — Completed
+- Installed `svelte-dnd-action` package
+- Created `DraggableBoard.svelte`, `DraggableSection.svelte`, `DraggableWidget.svelte` component hierarchy
+- Board edit page now uses DnD for section and widget reordering (including cross-section widget moves)
+- Added `PUT /api/boards/[id]/reorder` and `PUT /api/boards/[id]/sections/[sid]/reorder` endpoints
+- Extended `boardService.ts` with `reorderSections()`, `reorderWidgets()`, `moveWidget()` using Prisma transactions
+- Visual drag handles (grip dots) and dashed drop zone indicators added via Tailwind
+- Edit page actions (add/delete section/widget) use `invalidateAll()` for data refresh; DnD uses optimistic fetch