Add OIDC login support for Google and Microsoft providers

Implements OpenID Connect authentication flow with PKCE, JWT verification, and enterprise-only account restrictions. Adds OIDC service with JWKS caching and state management, HTTP handlers for login/callback flows, GraphQL query for available providers, and sign-in UI integration.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/connect/v1/v1_resolver.go

@@ -9,6 +9,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/99designs/gqlgen/graphql"
@@ -1746,6 +1747,21 @@ func (r *queryResolver) SsoLoginURL(ctx context.Context, email mail.Addr) (*stri
 	return &loginURL, nil
 }
 
+// OidcProviders is the resolver for the oidcProviders field.
+func (r *queryResolver) OidcProviders(ctx context.Context) ([]*types.OIDCProviderInfo, error) {
+	providers := r.iam.OIDCService.EnabledProviders()
+	result := make([]*types.OIDCProviderInfo, 0, len(providers))
+
+	for _, p := range providers {
+		result = append(result, &types.OIDCProviderInfo{
+			Name:     strings.ToLower(p.String()),
+			LoginURL: r.baseURL.WithPath("/api/connect/v1/oidc/" + strings.ToLower(p.String()) + "/login").MustString(),
+		})
+	}
+
+	return result, nil
+}
+
 // TestLoginURL is the resolver for the testLoginUrl field.
 func (r *sAMLConfigurationResolver) TestLoginURL(ctx context.Context, obj *types.SAMLConfiguration) (string, error) {
 	return r.baseURL.WithPath("/api/connect/v1/saml/2.0/" + obj.ID.String()).MustString(), nil