docs(server): document OIDC fail-fast on undecryptable providers (#98)

[bigpuritz]

Closes #98.

Plugwerk 1.0.0 added PLUGWERK_AUTH_OIDC_FAIL_FAST_ON_UNDECRYPTABLE_PROVIDERS (default false) as a production safety net for OIDC encryption-key mismatches. The 1.0.0 release notes (PR #105) call out that the feature exists; this PR is the operator-facing reference for it.

Files changed

File	What
server/configuration.mdx	1 new env-var row + new dedicated "OIDC encryption-key safety" section
server/oidc-providers.mdx	Best-practices bullet + Troubleshooting entry, both pointing at the configuration section

What the new section covers

• Context — when the failure happens (key rotation without re-encrypt, deployment-env switch, DB restore, fresh import with stale secrets).
• Default behaviour (false) — boot anyway, log + skip; with the actual Cannot decrypt OIDC provider … ERROR-line wording so operators can grep for it.
• Fail-fast (true) — boot refused, every affected registrationId listed in one shot; with the actual Refusing to start: … boot-failure wording.
• Production recommendation as :::tip — fail-fast in prod (a half-broken login surface is worse than a Kubernetes restart loop), default in dev (one broken provider should not block iteration on others).

Source verification

All env-var name, default, and on-the-wire log/error string copy verified against v1.0.0 source:

• plugwerk-server/.../security/DbClientRegistrationRepository.kt — flag plumbing, boot-failure message
• plugwerk-server/.../config/CryptoDiagnostics.kt — encryptionKeyMismatchMessage helper that builds the ERROR line

Source files read for accuracy, not cited in the docs (per the AGENTS.md no-internal-link rule). Internal-link grep returns 0 hits in the new content.

Note on the issue body

The issue says "covers the #479 leftover from closed issue #88". That predecessor was actually fully delivered by PR #93 — all three #479 SSRF properties (ALLOW_PRIVATE_DISCOVERY_URIS, BLOCKED_HOST_NAMES, BLOCKED_HOST_SUFFIXES) are documented today, with their own dedicated #oidc-ssrf-guard section. This PR is purely additive — adds the fourth PLUGWERK_AUTH_OIDC_* property and a sibling #oidc-encryption-key-safety section right next to it.

Acceptance criteria from #98

• PLUGWERK_AUTH_OIDC_FAIL_FAST_ON_UNDECRYPTABLE_PROVIDERS listed in the environment-variables reference.
• All four PLUGWERK_AUTH_OIDC_* properties documented together (the three SSRF ones were already in main from PR docs(server): document the OIDC SSRF guard env vars (#88) #93; this PR adds the fail-fast one to the same table block).
• Production-deployment / security guidance explains the trade-off and recommends the production setting (:::tip block in the new section + best-practices bullet in oidc-providers).
• Troubleshooting page links the Sign-in 4xx symptom to the Cannot decrypt … PLUGWERK_AUTH_ENCRYPTION_KEY log line.

Test plan

• npm run format clean
• npm run format:check clean
• npm run build clean (32 pages, no drift)
• AGENTS.md ADR/internal-PR grep clean in the new content
• Anchor #oidc-encryption-key-safety rendered on /server/configuration/
• Both cross-links from /server/oidc-providers/ resolve to that anchor
• Anchor #sign-in-with-provider-returns-4xx-but-the-server-is-healthy rendered on /server/oidc-providers/
• Reviewer: open /server/configuration/#oidc-encryption-key-safety, verify the :::tip block renders, the two log-line code blocks read clearly, and the cross-link to /server/oidc-providers/#sign-in-with-provider-returns-4xx-but-the-server-is-healthy lands on the new troubleshooting entry