fix(auth): add PKCE to OpenID Connect login

Generate a per-login verifier, persist it in the Goth session, send an S256 challenge, and include the verifier during the token exchange when explicitly enabled.

Assisted-by: Codex:GPT-5

modules/setting/oauth2.go

@@ -52,18 +52,20 @@ func (accountLinking OAuth2AccountLinkingType) isValid() bool {
 
 // OAuth2Client settings
 var OAuth2Client struct {
-	RegisterEmailConfirm   bool
-	OpenIDConnectScopes    []string
-	EnableAutoRegistration bool
-	Username               OAuth2UsernameType
-	UpdateAvatar           bool
-	AccountLinking         OAuth2AccountLinkingType
+	RegisterEmailConfirm    bool
+	OpenIDConnectScopes     []string
+	EnableOpenIDConnectPKCE bool
+	EnableAutoRegistration  bool
+	Username                OAuth2UsernameType
+	UpdateAvatar            bool
+	AccountLinking          OAuth2AccountLinkingType
 }
 
 func loadOAuth2ClientFrom(rootCfg ConfigProvider) {
 	sec := rootCfg.Section("oauth2_client")
 	OAuth2Client.RegisterEmailConfirm = sec.Key("REGISTER_EMAIL_CONFIRM").MustBool(Service.RegisterEmailConfirm)
 	OAuth2Client.OpenIDConnectScopes = parseScopes(sec, "OPENID_CONNECT_SCOPES")
+	OAuth2Client.EnableOpenIDConnectPKCE = sec.Key("ENABLE_OPENID_CONNECT_PKCE").MustBool()
 	OAuth2Client.EnableAutoRegistration = sec.Key("ENABLE_AUTO_REGISTRATION").MustBool()
 	OAuth2Client.Username = OAuth2UsernameType(sec.Key("USERNAME").MustString(string(OAuth2UsernameNickname)))
 	if !OAuth2Client.Username.isValid() {