feat(phase2): OAuth/Authentik integration + drag-and-drop reordering

- Add OIDC/OAuth2 login via openid-client with PKCE flow
- Auto-provision OAuth users with group mapping
- Conditional login page (OAuth/local/both based on auth mode)
- Admin OAuth test connection button
- Install svelte-dnd-action for board editor DnD
- Draggable sections and widgets with cross-section moves
- Reorder APIs with atomic Prisma transactions
- Visual drag handles and drop zone indicators

plans/phase-2-enhanced-features/PLAN.md

@@ -19,7 +19,7 @@ Add OAuth/Authentik integration, drag-and-drop reordering, localization (EN/RU),
 
 ## Phases
 
-- [ ] Phase 1: OAuth/Authentik Integration [fullstack] → [subplan](./phase-1-oauth.md)
+- [x] Phase 1: OAuth/Authentik Integration [fullstack] → [subplan](./phase-1-oauth.md)
 - [ ] Phase 2: Drag-and-Drop Reordering [frontend] → [subplan](./phase-2-dnd.md)
 - [ ] Phase 3: Localization EN/RU [fullstack] → [subplan](./phase-3-localization.md)
 - [ ] Phase 4: Additional Widget Types [fullstack] → [subplan](./phase-4-widgets.md)
@@ -30,8 +30,8 @@ Add OAuth/Authentik integration, drag-and-drop reordering, localization (EN/RU),
 
 | Phase | Domain | Status | Review | Build | Committed |
 |-------|--------|--------|--------|-------|-----------|
-| Phase 1: OAuth | fullstack | ⬜ Not Started | ⬜ | ⬜ | ⬜ |
-| Phase 2: DnD | frontend | ⬜ Not Started | ⬜ | ⬜ | ⬜ |
+| Phase 1: OAuth | fullstack | Done | ⬜ | ⬜ | ⬜ |
+| Phase 2: DnD | frontend | Done | ⬜ | ⬜ | ⬜ |
 | Phase 3: Localization | fullstack | ⬜ Not Started | ⬜ | ⬜ | ⬜ |
 | Phase 4: Widgets | fullstack | ⬜ Not Started | ⬜ | ⬜ | ⬜ |
 | Phase 5: Access Control | fullstack | ⬜ Not Started | ⬜ | ⬜ | ⬜ |