feat(dashboard): OIDC SSO + toggleable password login

[ServerSideHannes]

What

Adds OIDC single sign-on to the dashboard and makes username/password login toggleable, so the dashboard can be run SSO-only.

Went with OIDC rather than SAML: it covers JumpCloud fully (JumpCloud exposes a standard OIDC IdP), is generic across providers (Okta, Google, Entra ID, ...), and avoids the XML-signature machinery SAML needs. The implementation is a vanilla OpenID Connect authorization-code flow with PKCE, driven entirely by the issuer's .well-known/openid-configuration, so it isn't JumpCloud-specific.

How it works

• New s3proxy/dashboard/oidc.py: discovery, PKCE, code exchange, ID-token claim verification (iss/aud/exp/nonce), optional email-domain allowlist. In-flight login state is kept in Redis (single-use, short TTL).
• Routes under the existing {dashboard.path}/api: GET /api/authmodes, GET /api/oidc/login, GET /api/oidc/callback. The nginx reverse-proxy already forwards /api, so no proxy change.
• The login page fetches /api/authmodes and renders an SSO button, the password form, or both.
• At least one method must be enabled (startup error otherwise).

The ID token is read directly from the token endpoint (a back-channel HTTPS call to the issuer); per OIDC Core §3.1.3.7 signature validation MAY be skipped for tokens obtained this way over TLS, so standard claims are verified instead of fetching JWKS. No new runtime dependencies.

Configure (values.yaml)

dashboard:
  enabled: true
  auth:
    password:
      enabled: false        # SSO-only
    oidc:
      enabled: true
      issuer: "https://oauth.id.jumpcloud.com/"
      clientId: "<client-id>"
      clientSecret: "<client-secret>"   # or use existingSecret
      allowedDomains: "example.com"

JumpCloud: create an OIDC app, set the redirect URI to <dashboard-url>/dashboard/api/oidc/callback, issuer https://oauth.id.jumpcloud.com/. Client secret can live in your own Secret via dashboard.auth.oidc.existingSecret.

Tests

• tests/unit/test_dashboard_oidc.py — PKCE, claim decode, full login flow (mocked IdP via httpx MockTransport), nonce/domain enforcement, single-use state, authmodes, password-disabled rejection, SSO-only.
• tests/unit/test_chart_dashboard_auth.py — chart rendering across secret/env wiring permutations.
• Full unit suite (417 + new), ruff, helm lint, svelte-check, and a frontend build all pass.

[ServerSideHannes]

Follow-up: HTTPS + existing-secret

HTTPS status (before this change): the chart ran the proxy over plain HTTP in-cluster (server.noTls: true, no certs mounted); external HTTPS was only terminated at the Ingress. The session-cookie Secure flag tracks no_tls, and the OIDC redirect scheme is derived from X-Forwarded-Proto (pinnable via dashboard.auth.oidc.redirectUrl).

Added server.tls.existingSecret — point at an existing kubernetes.io/tls Secret to have the proxy pod terminate HTTPS itself:

kubectl create secret tls s3proxy-tls --cert=tls.crt --key=tls.key
helm upgrade s3proxy ... --set server.tls.existingSecret=s3proxy-tls

When set: noTls forced off, secret mounted at server.certPath (tls.crt/tls.key → s3proxy.crt/s3proxy.key), probes switch to scheme: HTTPS, the session cookie becomes Secure, and the dashboard nginx talks to the proxy over HTTPS (proxy_ssl_verify off, since the cert is for the external hostname).

The OIDC client-secret existing-secret (dashboard.auth.oidc.existingSecret) was already part of the original commit.

New chart tests cover both pod-TLS-on and the unchanged default. helm lint, ruff, and the chart test suite pass.