OAuth2 OpenID Connect provider support, API and DB refactoring (#3)

Allows Paskia to authenticate the user to a client site.
- User friendly client registration flow on the admin app
- Redirect-based authentication flow (per spec)
- Backchannel logout both ways to keep sessions synchronized
- Groups integrated with Paskia's permission system
- Adds email, preferred username and telephone fields on user profile
- All new user basic info layout to show the new information, better looks
- API and DB structures redesigned
- Various unrelated fixes to theming and layout

pyproject.toml

@@ -17,7 +17,7 @@ dependencies = [
     "webauthn>=1.11.1",
     "base64url>=1.0.0",
     "uuid7-standard>=1.0.0",
-    "pyjwt>=2.8.0",
+    "pyjwt[crypto]>=2.8.0",
     "jsondiff>=2.2.1",
     "msgspec>=0.20.0",
     "aiofiles>=25.1.0",