Merge origin/main into bugfix/rund-seeds-just-once

Resolved conflicts:
- CHANGELOG.md: keep FORCE_SEEDS and Seeds entries, keep OIDC/Unauthenticated from main
- auth_controller.ex: use sign_in_path_after_oidc_failure() for OIDC-only redirect
- oidc_only_sign_in_redirect.ex: take main's oidc_failed=1 handling
- gettext default.po: remove obsolete #~ block
- auth_controller_test.exs: keep test for oidc_failed=1 redirect loop

Made-with: Cursor

priv/gettext/de/LC_MESSAGES/default.po

@@ -3905,8 +3905,3 @@ msgstr "Nur OIDC-Anmeldung ist aktiv. Diese Option ist deaktiviert."
 #, elixir-autogen, elixir-format
 msgid "Only sign-in via Single Sign-On (SSO) is allowed."
 msgstr "Nur Anmeldung per Single Sign-On (SSO) ist erlaubt."
-
-#~ #: lib/accounts/user/validations/oidc_only_blocks_password_registration.ex
-#~ #, elixir-autogen, elixir-format
-#~ msgid "Registration with password is disabled when only OIDC sign-in is active."
-#~ msgstr "Registrierung mit Passwort ist deaktiviert, wenn nur OIDC-Anmeldung aktiv ist."

priv/gettext/en/LC_MESSAGES/default.po

@@ -3905,8 +3905,3 @@ msgstr ""
 #, elixir-autogen, elixir-format
 msgid "Only sign-in via Single Sign-On (SSO) is allowed."
 msgstr ""
-
-#~ #: lib/accounts/user/validations/oidc_only_blocks_password_registration.ex
-#~ #, elixir-autogen, elixir-format
-#~ msgid "Registration with password is disabled when only OIDC sign-in is active."
-#~ msgstr "Registration with password is disabled when only OIDC sign-in is active."