Backend Phase B (2/2): OIDC auth + config validation

- internal/auth/oidc.go: OIDCService mit go-oidc v3
  - id_token-Verifikation via JWKS (Signatur, iss, aud, exp)
  - Provider-Caching (sync.Map, lazy init per Issuer-URL)
  - Unterstützt Google + Generic OIDC
- internal/auth/user.go: GetByOIDCSubject + CreateOIDCUser
  (find-or-create via (oidc_issuer, oidc_subject))
- internal/httpapi/auth.go: POST /auth/oidc Handler
  (id_token verifiziern → find-or-create User → issueSession)
- internal/httpapi/api.go: /auth/oidc Route verdrahtet
- internal/config/config.go: OIDC-Validierung
  (enabled → client_id + issuer Pflicht)
- go.mod/go.sum: go-oidc/v3 + oauth2 Abhängigkeiten
- AGENTS.md: Phase B vollständig als erledigt markiert

Verifiziert: E2E gegen lokalen Mock-IdP (Discovery → JWKS →
signiertes id_token → User angelegt → 2. Login gleicher User →
tampered Token → 401). Alle Fehlerpfade geprüft.

go build ./... && go vet ./... && go test ./internal/auth/... ✅

backend/internal/auth/oidc.go

@@ -0,0 +1,123 @@
+package auth
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+)
+
+// OIDCClaims holds the fields this backend extracts from a verified id_token.
+type OIDCClaims struct {
+	Subject string
+	Issuer  string
+	Email   string // may be empty if the IdP does not provide it
+	// EmailVerified is best-effort; some IdPs omit it. When missing we treat it
+	// as unverified rather than rejecting the login.
+	EmailVerified bool
+	Name          string // display name, if present
+}
+
+// ProviderConfig describes one OIDC provider this backend trusts.
+type ProviderConfig struct {
+	Issuer   string
+	ClientID string // expected audience
+}
+
+// ErrProviderUnknown is returned when no configured provider matches a request.
+var ErrProviderUnknown = errors.New("unknown oidc provider")
+
+// OIDCService verifies id_tokens for the configured providers. Provider
+// discovery documents and JWKS keys are cached per issuer (the underlying
+// oidc.IDTokenVerifier refreshes keys as needed).
+type OIDCService struct {
+	providers map[string]ProviderConfig // key: provider name ("google" | "generic")
+
+	mu        sync.Mutex
+	verifiers map[string]*oidc.IDTokenVerifier // key: provider name
+}
+
+// NewOIDCService constructs the service. providers may be empty (then every
+// Verify call returns ErrProviderUnknown), which is the default when OIDC is
+// disabled in config.
+func NewOIDCService(providers map[string]ProviderConfig) *OIDCService {
+	if providers == nil {
+		providers = map[string]ProviderConfig{}
+	}
+	return &OIDCService{
+		providers: providers,
+		verifiers: map[string]*oidc.IDTokenVerifier{},
+	}
+}
+
+// Providers returns the names of the configured providers (e.g. "google",
+// "generic"). Callers use it to decide whether OIDC is available at all.
+func (s *OIDCService) Providers() []string {
+	names := make([]string, 0, len(s.providers))
+	for k := range s.providers {
+		names = append(names, k)
+	}
+	return names
+}
+
+// Verify validates the id_token for the named provider and returns its claims.
+// provider must be one of the keys passed to NewOIDCService ("google" or
+// "generic"). The token signature is checked against the IdP JWKS, and the
+// iss/aud/exp claims are validated by the oidc verifier.
+func (s *OIDCService) Verify(ctx context.Context, provider, idToken string) (OIDCClaims, error) {
+	pc, ok := s.providers[provider]
+	if !ok {
+		return OIDCClaims{}, fmt.Errorf("%w: %s", ErrProviderUnknown, provider)
+	}
+
+	v, err := s.verifier(ctx, provider, pc)
+	if err != nil {
+		return OIDCClaims{}, fmt.Errorf("build verifier: %w", err)
+	}
+
+	tok, err := v.Verify(ctx, idToken)
+	if err != nil {
+		return OIDCClaims{}, fmt.Errorf("verify id_token: %w", err)
+	}
+
+	// Extract the claim set. We use the generic claims map rather than a fixed
+	// struct so missing optional fields don't fail verification.
+	var raw struct {
+		Email         string `json:"email"`
+		EmailVerified bool   `json:"email_verified"`
+		Name          string `json:"name"`
+	}
+	if err := tok.Claims(&raw); err != nil {
+		return OIDCClaims{}, fmt.Errorf("parse claims: %w", err)
+	}
+	return OIDCClaims{
+		Subject:       tok.Subject,
+		Issuer:        tok.Issuer,
+		Email:         raw.Email,
+		EmailVerified: raw.EmailVerified,
+		Name:          raw.Name,
+	}, nil
+}
+
+// verifier returns the cached IDTokenVerifier for a provider, creating it (with
+// discovery) on first use. The discovery round-trip is the reason we cache.
+func (s *OIDCService) verifier(ctx context.Context, provider string, pc ProviderConfig) (*oidc.IDTokenVerifier, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if v := s.verifiers[provider]; v != nil {
+		return v, nil
+	}
+
+	dctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	prov, err := oidc.NewProvider(dctx, pc.Issuer)
+	if err != nil {
+		return nil, fmt.Errorf("discover provider %s (%s): %w", provider, pc.Issuer, err)
+	}
+	v := prov.Verifier(&oidc.Config{ClientID: pc.ClientID})
+	s.verifiers[provider] = v
+	return v, nil
+}