feat(auth): Configure Authentik OIDC integration with better-auth

- Add genericOAuth plugin to auth.config.ts with Authentik provider
- Fix LoginButton to use /auth/signin/authentik (not /auth/callback/)
- Add production URLs to trustedOrigins
- Update .env.example with correct redirect URI documentation

Redirect URI for Authentik: https://api.mosaicstack.dev/auth/callback/authentik

Co-Authored-By: Claude Opus 4.5 <[email protected]>

apps/web/src/components/auth/LoginButton.test.tsx

@@ -32,9 +32,7 @@ describe("LoginButton", (): void => {
     const button = screen.getByRole("button", { name: /sign in/i });
     await user.click(button);
 
-    expect(mockLocation.assign).toHaveBeenCalledWith(
-      "http://localhost:3001/auth/callback/authentik"
-    );
+    expect(mockLocation.assign).toHaveBeenCalledWith("http://localhost:3001/auth/signin/authentik");
   });
 
   it("should have proper styling", (): void => {

apps/web/src/components/auth/LoginButton.tsx

@@ -8,7 +8,7 @@ export function LoginButton(): React.JSX.Element {
   const handleLogin = (): void => {
     // Redirect to the backend OIDC authentication endpoint
     // BetterAuth will handle the OIDC flow and redirect back to the callback
-    window.location.assign(`${API_URL}/auth/callback/authentik`);
+    window.location.assign(`${API_URL}/auth/signin/authentik`);
   };
 
   return (