Backend Phase B (2/2): OIDC auth + config validation

- internal/auth/oidc.go: OIDCService mit go-oidc v3
  - id_token-Verifikation via JWKS (Signatur, iss, aud, exp)
  - Provider-Caching (sync.Map, lazy init per Issuer-URL)
  - Unterstützt Google + Generic OIDC
- internal/auth/user.go: GetByOIDCSubject + CreateOIDCUser
  (find-or-create via (oidc_issuer, oidc_subject))
- internal/httpapi/auth.go: POST /auth/oidc Handler
  (id_token verifiziern → find-or-create User → issueSession)
- internal/httpapi/api.go: /auth/oidc Route verdrahtet
- internal/config/config.go: OIDC-Validierung
  (enabled → client_id + issuer Pflicht)
- go.mod/go.sum: go-oidc/v3 + oauth2 Abhängigkeiten
- AGENTS.md: Phase B vollständig als erledigt markiert

Verifiziert: E2E gegen lokalen Mock-IdP (Discovery → JWKS →
signiertes id_token → User angelegt → 2. Login gleicher User →
tampered Token → 401). Alle Fehlerpfade geprüft.

go build ./... && go vet ./... && go test ./internal/auth/... ✅

backend/internal/auth/user.go

@@ -93,3 +93,54 @@ func (s *UserStore) GetUserByID(ctx context.Context, id uuid.UUID) (User, error)
 	u.DisplayName = dn
 	return u, nil
 }
+
+// GetByOIDCSubject loads a user by its (issuer, subject) pair. This is the key
+// used to recognise a returning user across OIDC logins.
+func (s *UserStore) GetByOIDCSubject(ctx context.Context, issuer, subject string) (User, error) {
+	const q = `
+		SELECT id, email, password_hash, oidc_subject, oidc_issuer, display_name
+		FROM users WHERE oidc_issuer = $1 AND oidc_subject = $2`
+	var u User
+	var dn *string
+	err := s.pool.QueryRow(ctx, q, issuer, subject).
+		Scan(&u.ID, &u.Email, &u.PasswordHash, &u.OIDCSubject, &u.OIDCIssuer, &dn)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return User{}, ErrUserNotFound
+		}
+		return User{}, fmt.Errorf("get user by oidc subject: %w", err)
+	}
+	u.DisplayName = dn
+	return u, nil
+}
+
+// CreateOIDCUser inserts a new user for an OIDC login. The user has no password
+// (password_hash is NULL) and is identified by (issuer, subject). email may be
+// empty if the IdP did not provide one; we store a synthesized placeholder so
+// the NOT NULL + UNIQUE constraints hold and the account stays addressable.
+func (s *UserStore) CreateOIDCUser(ctx context.Context, issuer, subject, email, displayName string) (User, error) {
+	if email == "" {
+		// Synthesize a stable, non-resolvable address for IdPs that don't return
+		// an email (rare for Google, possible for generic providers).
+		email = fmt.Sprintf("%s@oidc.local", subject)
+	}
+	const q = `
+		INSERT INTO users (email, password_hash, oidc_subject, oidc_issuer, display_name)
+		VALUES ($1, NULL, $2, $3, NULLIF($4, ''))
+		RETURNING id, email, password_hash, oidc_subject, oidc_issuer, display_name`
+	var u User
+	var dn *string
+	err := s.pool.QueryRow(ctx, q, email, subject, issuer, displayName).
+		Scan(&u.ID, &u.Email, &u.PasswordHash, &u.OIDCSubject, &u.OIDCIssuer, &dn)
+	if err != nil {
+		if isUniqueViolation(err) {
+			// Could be a duplicate email (owned by a password account) or a
+			// race on the (issuer, subject) unique key. Surface a generic
+			// conflict; the handler decides the HTTP code.
+			return User{}, fmt.Errorf("%w: oidc account conflict", ErrEmailTaken)
+		}
+		return User{}, fmt.Errorf("create oidc user: %w", err)
+	}
+	u.DisplayName = dn
+	return u, nil
+}