[codex] Improve OIDC auth UI and context flow

[winetree94]

Summary

• Add a validated OAuth authorization-context API for pre-auth login and registration screens.
• Show the requesting client, redirect origin, and requested scopes across OIDC login/register entry points.
• Improve auth form accessibility with labels, hints, ARIA wiring, clearer terms controls, and responsive layout polish.
• Update route, server, and Playwright tests for the new OIDC-aware login flow.

Why

The OIDC provider login and signup screens did not clearly communicate which client application was requesting authentication before the user authenticated. This made the flow harder to trust and less aligned with the post-login consent step.

Impact

Users now see validated client and permission context earlier in the flow, password-only deployments land directly on the password form, and auth forms have stronger accessibility semantics across supported languages.

Validation

• git diff --cached --check
• pnpm biome check .
• pnpm build
• pnpm test 2>&1 | Select-Object -Last 200
• Targeted frontend route unit tests for login/password/register and route test utilities
• Server authorization-context route tests
• Targeted Playwright minimal OIDC/auth tests
• Theme/system multilingual Playwright tests

Note: Windows did not have tail, so the documented tail -200 test summary command was run with PowerShell's Select-Object -Last 200 equivalent. Full tests exited successfully; Playwright reported three Firefox account-selection cases as flaky after retry, then passed.