fix(auth): add PKCE to OpenID Connect login

Generate a per-login verifier, persist it in the Goth session, send an S256 challenge, and include the verifier during the token exchange when explicitly enabled.

Assisted-by: Codex:GPT-5

modules/setting/oauth2_test.go

@@ -76,3 +76,15 @@ DEFAULT_APPLICATIONS =
 	loadOAuth2From(cfg)
 	assert.Nil(t, OAuth2.DefaultApplications)
 }
+
+func TestOAuth2ClientOpenIDConnectPKCE(t *testing.T) {
+	cfg, _ := NewConfigProviderFromData(``)
+	loadOAuth2ClientFrom(cfg)
+	assert.False(t, OAuth2Client.EnableOpenIDConnectPKCE)
+
+	cfg, _ = NewConfigProviderFromData(`[oauth2_client]
+ENABLE_OPENID_CONNECT_PKCE = true
+`)
+	loadOAuth2ClientFrom(cfg)
+	assert.True(t, OAuth2Client.EnableOpenIDConnectPKCE)
+}