Add OIDC provider for Outline wiki SSO

Add oidc-provider with MongoDB adapter so ghostguild.org can act as
the identity provider for the self-hosted Outline wiki. Members
authenticate via the existing magic-link flow, with automatic SSO
when an active session exists. Includes interaction routes, well-known
discovery endpoint, and login page.

server/routes/.well-known/openid-configuration.get.ts

@@ -0,0 +1,24 @@
+/**
+ * Forward /.well-known/openid-configuration to the oidc-provider.
+ *
+ * The provider generates this discovery document automatically, but since the
+ * catch-all route is mounted under /oidc/, requests to /.well-known/ need
+ * explicit forwarding.
+ */
+import { getOidcProvider } from "../../utils/oidc-provider.js";
+
+export default defineEventHandler(async (event) => {
+  const provider = await getOidcProvider();
+  const { req, res } = event.node;
+
+  // The provider expects the path relative to its root
+  req.url = "/.well-known/openid-configuration";
+
+  const callback = provider.callback() as Function;
+  await new Promise<void>((resolve, reject) => {
+    callback(req, res, (err: unknown) => {
+      if (err) reject(err);
+      else resolve();
+    });
+  });
+});