feat(auth): add OIDC SSO and registration controls

Add OIDC discovery, JWKS validation, Socialite integration, OAuth identity linking, and configurable registration policy for password and SSO signups. Update related settings/profile UI and tests.

database/migrations/2026_05_29_000000_encrypt_application_deployment_configuration_columns.php

@@ -11,12 +11,20 @@ return new class extends Migration
      */
     public function up(): void
     {
+        if (DB::connection()->getDriverName() === 'sqlite') {
+            return;
+        }
+
         DB::statement('ALTER TABLE application_deployment_queues ALTER COLUMN configuration_snapshot TYPE text USING configuration_snapshot::text');
         DB::statement('ALTER TABLE application_deployment_queues ALTER COLUMN configuration_diff TYPE text USING configuration_diff::text');
     }
 
     public function down(): void
     {
+        if (DB::connection()->getDriverName() === 'sqlite') {
+            return;
+        }
+
         DB::statement('ALTER TABLE application_deployment_queues ALTER COLUMN configuration_snapshot TYPE json USING configuration_snapshot::json');
         DB::statement('ALTER TABLE application_deployment_queues ALTER COLUMN configuration_diff TYPE json USING configuration_diff::json');
     }

database/migrations/2026_06_04_091631_add_oidc_fields_to_oauth_settings_table.php

@@ -0,0 +1,40 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('oauth_settings', function (Blueprint $table) {
+            $table->string('custom_label')->nullable();
+            $table->string('scopes')->nullable();
+            $table->boolean('allow_registration')->default(true);
+            $table->boolean('require_email_verified')->default(true);
+            $table->boolean('use_pkce')->default(true);
+            $table->unsignedSmallInteger('clock_skew_seconds')->default(60);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('oauth_settings', function (Blueprint $table) {
+            $table->dropColumn([
+                'custom_label',
+                'scopes',
+                'allow_registration',
+                'require_email_verified',
+                'use_pkce',
+                'clock_skew_seconds',
+            ]);
+        });
+    }
+};

database/migrations/2026_06_04_091631_create_oauth_identities_table.php

@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('oauth_identities', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
+            $table->string('provider');
+            $table->string('issuer');
+            $table->string('provider_user_id');
+            $table->string('email')->nullable()->index();
+            $table->json('raw_claims')->nullable();
+            $table->timestamp('last_login_at')->nullable();
+            $table->timestamps();
+
+            $table->unique(['provider', 'issuer', 'provider_user_id'], 'oauth_identity_provider_issuer_user_unique');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('oauth_identities');
+    }
+};

database/migrations/2026_06_04_091632_add_oauth_registration_policy_to_instance_settings_table.php

@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->boolean('disable_registration_when_oauth_enabled')->default(false);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->dropColumn('disable_registration_when_oauth_enabled');
+        });
+    }
+};

database/seeders/OauthSettingSeeder.php

@@ -22,6 +22,7 @@ class OauthSettingSeeder extends Seeder
                 'github',
                 'gitlab',
                 'google',
+                'oidc',
                 'authentik',
                 'infomaniak',
                 'zitadel',