feat(#413): add OIDC provider health check with 30s cache

- isOidcProviderReachable() fetches discovery URL with 2s timeout
- getAuthConfig() omits authentik when provider unreachable
- 30-second cache prevents repeated network calls

Refs #413

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/auth/auth.controller.ts

@@ -97,7 +97,7 @@ export class AuthController {
    */
   @Get("config")
   @Header("Cache-Control", "public, max-age=300")
-  getConfig(): AuthConfigResponse {
+  async getConfig(): Promise<AuthConfigResponse> {
     return this.authService.getAuthConfig();
   }