Merge origin/main into bugfix/rund-seeds-just-once

Resolved conflicts:
- CHANGELOG.md: keep FORCE_SEEDS and Seeds entries, keep OIDC/Unauthenticated from main
- auth_controller.ex: use sign_in_path_after_oidc_failure() for OIDC-only redirect
- oidc_only_sign_in_redirect.ex: take main's oidc_failed=1 handling
- gettext default.po: remove obsolete #~ block
- auth_controller_test.exs: keep test for oidc_failed=1 redirect loop

Made-with: Cursor

docs/admin-bootstrap-and-oidc-role-sync.md

@@ -39,6 +39,7 @@
 ### Sign-in page (OIDC-only mode)
 
 - `OIDC_ONLY` (or Settings → OIDC → "Only OIDC sign-in") – When set to true/1/yes and OIDC is configured, the sign-in page shows only the Single Sign-On button (password login is hidden). ENV takes precedence over Settings.
+- **Redirect loop fix:** After an OIDC failure (e.g. provider down), the app redirects to `/sign-in?oidc_failed=1`. The plug `OidcOnlySignInRedirect` does not redirect that request back to OIDC, so the sign-in page is shown with the error (no endless redirect).
 
 ### Sync Logic