feat: OIDC configuration in global Settings (ENV or DB)

- Add oidc_* attributes to Setting, migration and Config helpers
- Secrets and OidcRoleSyncConfig read from Config (ENV overrides DB)
- GlobalSettingsLive: OIDC section with disabled fields when ENV set
- OIDC role sync tests use DataCase for DB access

priv/repo/migrations/20260224122831_add_oidc_to_settings.exs

@@ -0,0 +1,29 @@
+defmodule Mv.Repo.Migrations.AddOidcToSettings do
+  @moduledoc """
+  Adds OIDC configuration columns to settings (ENV-overridable in UI).
+  """
+
+  use Ecto.Migration
+
+  def up do
+    alter table(:settings) do
+      add :oidc_client_id, :string
+      add :oidc_base_url, :string
+      add :oidc_redirect_uri, :string
+      add :oidc_client_secret, :string
+      add :oidc_admin_group_name, :string
+      add :oidc_groups_claim, :string
+    end
+  end
+
+  def down do
+    alter table(:settings) do
+      remove :oidc_client_id
+      remove :oidc_base_url
+      remove :oidc_redirect_uri
+      remove :oidc_client_secret
+      remove :oidc_admin_group_name
+      remove :oidc_groups_claim
+    end
+  end
+end