feat(auth): Configure Authentik OIDC integration with better-auth

- Add genericOAuth plugin to auth.config.ts with Authentik provider
- Fix LoginButton to use /auth/signin/authentik (not /auth/callback/)
- Add production URLs to trustedOrigins
- Update .env.example with correct redirect URI documentation

Redirect URI for Authentik: https://api.mosaicstack.dev/auth/callback/authentik

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.env.example

@@ -50,7 +50,10 @@ KNOWLEDGE_CACHE_TTL=300
 OIDC_ISSUER=https://auth.example.com/application/o/mosaic-stack/
 OIDC_CLIENT_ID=your-client-id-here
 OIDC_CLIENT_SECRET=your-client-secret-here
-OIDC_REDIRECT_URI=http://localhost:3001/auth/callback
+# Redirect URI must match what's configured in Authentik
+# Development: http://localhost:3001/auth/callback/authentik
+# Production: https://api.mosaicstack.dev/auth/callback/authentik
+OIDC_REDIRECT_URI=http://localhost:3001/auth/callback/authentik
 
 # Authentik PostgreSQL Database
 AUTHENTIK_POSTGRES_USER=authentik