Remove OIDC authorization flow to fix data race vulnerability (#526)

## Summary

Fixes a concurrent map access vulnerability in the OIDC handler that
could cause remote unauthenticated DoS.

## Changes

- Removed OIDC authorization flow endpoints ( and )
- Removed the unsynchronized  map that caused the data race
- Kept only the OIDC token exchange endpoint ()
- Simplified  by removing OAuth2 flow dependencies

The map was being accessed concurrently by the start (write) and
callback (read/delete) endpoints without synchronization, causing
runtime panics. Since the token exchange flow doesn't require session
state, removing the authorization flow eliminates the vulnerability
entirely.

internal/config/config.go

@@ -29,7 +29,6 @@ type Config struct {
 	OIDCEnabled      bool   `env:"OIDC_ENABLED" envDefault:"false"`
 	OIDCIssuer       string `env:"OIDC_ISSUER" envDefault:""`
 	OIDCClientID     string `env:"OIDC_CLIENT_ID" envDefault:""`
-	OIDCClientSecret string `env:"OIDC_CLIENT_SECRET" envDefault:""`
 	OIDCExtraClaims  string `env:"OIDC_EXTRA_CLAIMS" envDefault:""`
 	OIDCEditPerms    string `env:"OIDC_EDIT_PERMISSIONS" envDefault:""`
 	OIDCPublishPerms string `env:"OIDC_PUBLISH_PERMISSIONS" envDefault:""`