add configurable OAuth auth plugin support

Introduce a new rms.auth.oauth auth method plugin for OAuth/OIDC code flow with standard provider settings (authorize/token/userinfo URLs, client credentials, scope, redirect URI and extra params). Add server callback handling and OAuth challenge state tracking, UI redirect/error handling, and keep the plugin disabled by default via manifest defaultEnabled=false.

public/app.js

@@ -903,6 +903,10 @@ async function requestAccess() {
       body: { email, method },
       authRequired: false
     });
+    if (result && result.challengeType === "oauth" && result.authorizeUrl) {
+      window.location.assign(String(result.authorizeUrl));
+      return;
+    }
     els.otpWrap.hidden = result.challengeType !== "otp";
     renderMessage(els.authMessage, result.message || "Bitte E-Mail pruefen.", false, true);
   } catch (error) {
@@ -984,6 +988,15 @@ async function handleEmailTokenFromUrl() {
   }
 
   const token = url.searchParams.get("verifyToken") || url.searchParams.get("loginToken");
+  const authError = url.searchParams.get("authError");
+  if (authError) {
+    const authMessage = url.searchParams.get("authMessage") || "OAuth Anmeldung fehlgeschlagen.";
+    renderMessage(els.authMessage, authMessage, true);
+    url.searchParams.delete("authError");
+    url.searchParams.delete("authMessage");
+    window.history.replaceState({}, "", `${url.pathname}${url.search}`);
+    return;
+  }
   if (!token) {
     return;
   }