feat(frontend): make Zitadel client secret optional (support PKCE apps)

Configure openid-client with None auth (public client + PKCE) when no secret is
provided, so both PKCE and confidential (Code) Zitadel web apps work.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/server/auth.ts

@@ -25,13 +25,13 @@ export function getOidcConfig(): Promise<client.Configuration> {
 		const issuer = new URL(env.ZITADEL_ISSUER);
 		const options =
 			issuer.protocol === 'http:' ? { execute: [client.allowInsecureRequests] } : undefined;
-		return client.discovery(
-			issuer,
-			env.ZITADEL_CLIENT_ID,
-			env.ZITADEL_CLIENT_SECRET,
-			undefined,
-			options
-		);
+
+		const secret = env.ZITADEL_CLIENT_SECRET;
+		const hasSecret = !!secret && !secret.startsWith('REPLACE_');
+
+		return hasSecret
+			? client.discovery(issuer, env.ZITADEL_CLIENT_ID, secret, undefined, options)
+			: client.discovery(issuer, env.ZITADEL_CLIENT_ID, undefined, client.None(), options);
 	})();
 	return configPromise;
 }