feat(phase2): OAuth/Authentik integration + drag-and-drop reordering

- Add OIDC/OAuth2 login via openid-client with PKCE flow
- Auto-provision OAuth users with group mapping
- Conditional login page (OAuth/local/both based on auth mode)
- Admin OAuth test connection button
- Install svelte-dnd-action for board editor DnD
- Draggable sections and widgets with cross-section moves
- Reorder APIs with atomic Prisma transactions
- Visual drag handles and drop zone indicators

src/lib/components/board/DraggableBoard.svelte

@@ -0,0 +1,127 @@
+<script lang="ts">
+	import { dndzone } from 'svelte-dnd-action';
+	import DraggableSection from '$lib/components/section/DraggableSection.svelte';
+
+	interface WidgetData {
+		id: string;
+		type: string;
+		order: number;
+		config: string;
+		appId: string | null;
+		sectionId: string;
+		app: {
+			id: string;
+			name: string;
+			url: string;
+			icon: string | null;
+			iconType: string;
+			description: string | null;
+			statuses: Array<{ status: string; responseTime: number | null }>;
+		} | null;
+	}
+
+	interface SectionData {
+		id: string;
+		title: string;
+		icon: string | null;
+		order: number;
+		isExpandedByDefault: boolean;
+		widgets: WidgetData[];
+	}
+
+	interface Props {
+		boardId: string;
+		sections: SectionData[];
+		apps: Array<{ id: string; name: string }>;
+		addWidgetSectionId: string | null;
+		onToggleAddWidget: (sectionId: string) => void;
+		onDeleteSection: (sectionId: string) => void;
+		onAddWidget: (sectionId: string, appId: string) => void;
+		onDeleteWidget: (widgetId: string) => void;
+	}
+
+	let {
+		boardId,
+		sections: initialSections,
+		apps,
+		addWidgetSectionId,
+		onToggleAddWidget,
+		onDeleteSection,
+		onAddWidget,
+		onDeleteWidget
+	}: Props = $props();
+
+	let sections = $state<SectionData[]>([...initialSections]);
+
+	// Keep local state in sync when parent data changes
+	$effect(() => {
+		sections = [...initialSections];
+	});
+
+	const flipDurationMs = 200;
+
+	function handleConsider(e: CustomEvent<{ items: SectionData[] }>) {
+		sections = e.detail.items;
+	}
+
+	async function handleFinalize(e: CustomEvent<{ items: SectionData[] }>) {
+		sections = e.detail.items;
+		const sectionIds = sections.map((s) => s.id);
+
+		try {
+			await fetch(`/api/boards/${boardId}/reorder`, {
+				method: 'PUT',
+				headers: { 'Content-Type': 'application/json' },
+				body: JSON.stringify({ sectionIds })
+			});
+		} catch (err) {
+			console.error('Failed to persist section reorder:', err);
+		}
+	}
+
+	async function handleWidgetsUpdate(sectionId: string, widgets: WidgetData[]) {
+		// Update local state
+		sections = sections.map((s) => (s.id === sectionId ? { ...s, widgets } : s));
+
+		const widgetIds = widgets.map((w) => w.id);
+
+		try {
+			await fetch(`/api/boards/${boardId}/sections/${sectionId}/reorder`, {
+				method: 'PUT',
+				headers: { 'Content-Type': 'application/json' },
+				body: JSON.stringify({ widgetIds })
+			});
+		} catch (err) {
+			console.error('Failed to persist widget reorder:', err);
+		}
+	}
+</script>
+
+{#if sections.length === 0}
+	<div class="rounded-xl border border-border bg-card/50 p-8 text-center">
+		<p class="text-muted-foreground">No sections yet. Add one to get started.</p>
+	</div>
+{:else}
+	<div
+		use:dndzone={{ items: sections, flipDurationMs, dropTargetStyle: {} }}
+		onconsider={handleConsider}
+		onfinalize={handleFinalize}
+		class="space-y-4"
+	>
+		{#each sections as section (section.id)}
+			<div>
+				<DraggableSection
+					{section}
+					{boardId}
+					{apps}
+					onWidgetsUpdate={handleWidgetsUpdate}
+					{addWidgetSectionId}
+					{onToggleAddWidget}
+					{onDeleteSection}
+					{onAddWidget}
+					{onDeleteWidget}
+				/>
+			</div>
+		{/each}
+	</div>
+{/if}