feat(frontend): server-side Zitadel OIDC auth (part 2)

Add Authorization Code + PKCE login/logout against Zitadel, handled entirely
server-side with an httpOnly signed session cookie:
- $lib/server/auth: openid-client discovery (config cached), jose-signed
  session encode/decode, cookie/name constants
- routes: /login (builds the authorize URL with PKCE/state/nonce, ?mode=register
  -> prompt=create), /auth/callback (code exchange + session cookie),
  /logout (clears session + Zitadel end_session)
- hooks.server populates locals.user/accessToken from the session
- +layout.server exposes the user; Navbar shows the signed-in user + Salir,
  or Iniciar sesión / Registrarse
- switch to adapter-node; env-driven config (.env gitignored, .env.example
  committed) with issuer http://host.docker.internal:8080

Verified: svelte-check + build clean; dev smoke test shows the landing in the
logged-out state and /login issuing a 302 to Zitadel's authorize endpoint with
PKCE/state/nonce (discovery reachable). Real client id/secret still needed to
complete the token exchange.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/.env.example

@@ -0,0 +1,14 @@
+# Zitadel OIDC (server-side auth)
+ZITADEL_ISSUER=http://host.docker.internal:8080
+ZITADEL_CLIENT_ID=your-web-app-client-id
+ZITADEL_CLIENT_SECRET=your-web-app-client-secret
+
+# Where Zitadel redirects back after login (must be registered in the app)
+AUTH_REDIRECT_URI=http://localhost:5173/auth/callback
+AUTH_POST_LOGOUT_URI=http://localhost:5173/
+
+# Secret used to sign the session cookie (any long random string)
+SESSION_SECRET=change-me-to-a-long-random-string
+
+# Backend API base URL (used from later parts)
+API_BASE_URL=http://localhost:5111