Add OIDC provider functionality with validation setup

This commit adds OpenID Connect (OIDC) provider functionality to tinyauth,
allowing it to act as an OIDC identity provider for other applications.

Features:
- OIDC discovery endpoint at /.well-known/openid-configuration
- Authorization endpoint for OAuth 2.0 authorization code flow
- Token endpoint for exchanging authorization codes for tokens
- ID token generation with JWT signing
- JWKS endpoint for public key distribution
- Support for PKCE (code challenge/verifier)
- Nonce validation for ID tokens
- Configurable OIDC clients with redirect URIs, scopes, and grant types

Validation:
- Docker Compose setup for local testing
- OIDC test client (oidc-whoami) with session management
- Nginx reverse proxy configuration
- DNS server (dnsmasq) for custom domain resolution
- Chrome launch script for easy testing

Configuration:
- OIDC configuration in config.yaml
- Example configuration in config.example.yaml
- Database migrations for OIDC client storage

validation/launch-chrome-host.sh

@@ -0,0 +1,39 @@
+#!/bin/bash
+# Launch Chrome from host (not in container)
+# This script should be run on your host machine
+
+set -e
+
+echo "Launching Chrome for OIDC test setup..."
+
+# Detect Chrome
+if command -v google-chrome &> /dev/null; then
+    CHROME_CMD="google-chrome"
+elif command -v chromium-browser &> /dev/null; then
+    CHROME_CMD="chromium-browser"
+elif command -v chromium &> /dev/null; then
+    CHROME_CMD="chromium"
+elif [ -f "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" ]; then
+    CHROME_CMD="/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
+else
+    echo "Error: Chrome not found. Please install Google Chrome or Chromium."
+    exit 1
+fi
+
+echo "Using: $CHROME_CMD"
+echo "Opening: http://client.example.com/ (OIDC test client)"
+echo ""
+
+$CHROME_CMD \
+    --host-resolver-rules="MAP auth.example.com 127.0.0.1, MAP client.example.com 127.0.0.1" \
+    --disable-features=HttpsOnlyMode \
+    --unsafely-treat-insecure-origin-as-secure=http://auth.example.com,http://client.example.com \
+    --user-data-dir=/tmp/chrome-test-profile-$(date +%s) \
+    --new-window \
+    http://client.example.com/ \
+    > /dev/null 2>&1 &
+
+echo "Chrome launched!"
+echo "OIDC test client: http://client.example.com/"
+echo "Tinyauth: http://auth.example.com/"
+