feat(oauth): support desktop-specific OIDC issuer and client_id discovery

[pat-s]

fix #246

Enables identity providers that require separate OIDC clients per application type (like Authentik, Kanidm, Zitadel) to work with the desktop client.

• Discover desktop-specific OIDC issuer via WebFinger (http://openid.net/specs/connect/1.0/issuer/desktop)
• Use server-provided client_id from WebFinger link properties when available
• Persist and restore client_id across re-authentication

Server-side changes

To work, this PR requires changes in https://github.com/opencloud-eu/opencloud.
A complementary PR is available at opencloud-eu/opencloud#2072.

Additionally, the following env vars must be set on the admin side:

WEBFINGER_OIDC_ISSUER_DESKTOP: <>
WEBFINGER_OIDC_CLIENT_ID_DESKTOP: <>

Here, WEBFINGER_OIDC_ISSUER_DESKTOP is usually the root URL of the identity provider and WEBFINGER_OIDC_CLIENT_ID_DESKTOP contains the client_id of the respective oAuth project.

---

With these changes, I was able to login into the Desktop app with a dedicated oAuth project through Zitadel (v4.7.0). The implementation should be generic and work with other oAuth providers as well.

[pat-s]

After opencloud-eu/opencloud#2072 got merged: are there changes needed here? @rhafer you might know best.

It might even be needed to issue a new release in sync with v5.2.0 then to be able to make use of the new issuer behavior.

[Chanceium]

@pat-s i noticed server was merged as well for 5.2.0 but client is still requesting client id "OpenCloudDesktop" does openclouddesktop need this merge as well

[pat-s]

@Chanceium Yes, changes are needed to make this work.

[Chanceium]

@Chanceium Yes, changes are needed to make this work.

Let's get this pushed 😭

[guruz]

Hi @pat-s I'm trying to get an overview here about the different open PRs..
Do I see it correctly that this PR is just for client_id, while the #847 (+ base PRs or whateber?) is also for scope?
CC @kaivol

[kaivol]

As far as I can tell the implementations differ in some places.

For example, I would suggest that persisting the clientId (see here) is not a good idea.
Also, I'd argue that the additional restructuring in my PRs makes a lot of sense, in particular the improvement described in #776 (comment).