Instance-global OIDC provider; per-domain auth hosts with shared-host resolution

- DB.oidc is a single OIDC (one key, one client set); hosts are issuer
  aliases. OIDCCode drops its rp_id field; client CRUD is not keyed by
  domain.
- No cross-domain auth-host fallback: a domain without its own auth host
  uses its own hosts; several domains may share one auth host (nested
  rp-ids) with deterministic best-suffix resolution.
- '*' origin shorthand expands to '*.{rp-id}'; legacy wildcards convert
  as-is; related origins may point at/inside another domain's rp-id.
- Admin UI and docs updated to match.

frontend/auth/admin/AdminApp.vue

@@ -1098,6 +1098,7 @@ async function submitDialog() {
                   ref="adminOidcDetailRef"
                   :client="editingOidcClient"
                   :permissions="permissions"
+                  :domains="domains"
                   :is-new="editingOidcClient.isNew"
                   :navigation-disabled="hasActiveModal"
                   @save="handleOidcSave"