feat(phase2): OAuth/Authentik integration + drag-and-drop reordering

- Add OIDC/OAuth2 login via openid-client with PKCE flow
- Auto-provision OAuth users with group mapping
- Conditional login page (OAuth/local/both based on auth mode)
- Admin OAuth test connection button
- Install svelte-dnd-action for board editor DnD
- Draggable sections and widgets with cross-section moves
- Reorder APIs with atomic Prisma transactions
- Visual drag handles and drop zone indicators

src/routes/login/+page.server.ts

@@ -5,6 +5,9 @@ import { fail, redirect } from '@sveltejs/kit';
 import { loginSchema } from '$lib/utils/validators.js';
 import * as userService from '$lib/server/services/userService.js';
 import * as authService from '$lib/server/services/authService.js';
+import { prisma } from '$lib/server/prisma.js';
+import { DEFAULTS } from '$lib/utils/constants.js';
+import type { AuthMode } from '$lib/utils/constants.js';
 
 const COOKIE_BASE = {
 	httpOnly: true,
@@ -19,8 +22,15 @@ export const load: PageServerLoad = async ({ locals }) => {
 		throw redirect(302, '/');
 	}
 
+	// Load auth mode from SystemSettings
+	const settings = await prisma.systemSettings.findUnique({
+		where: { id: DEFAULTS.SYSTEM_SETTINGS_ID },
+		select: { authMode: true }
+	});
+	const authMode: AuthMode = (settings?.authMode as AuthMode) || 'local';
+
 	const form = await superValidate(zod(loginSchema));
-	return { form };
+	return { form, authMode };
 };
 
 export const actions: Actions = {