feat(backend): add OAuth2/JWT authentication support

- Add OAuth2 client for Authentik integration
- Implement JWT token generation and validation
- Add refresh token support with database storage
- Update database schema with oauth_subject, oauth_provider, and refresh_tokens table
- Create auth package with config, jwt, oauth, and token management
- Add OAuth endpoints: /auth/login, /auth/callback, /auth/refresh, /auth/logout
- Update AuthMiddleware to support both JWT and API key authentication
- Add user helper functions for OAuth user creation and retrieval
- Add .env.example with OAuth configuration template

API keys still work for CLI compatibility while JWT tokens support web/mobile clients.

opal-task/internal/api/server.go

@@ -39,6 +39,12 @@ func (s *Server) setupRoutes() {
 		JSON(w, http.StatusOK, map[string]string{"status": "ok"})
 	})
 
+	// OAuth endpoints (no auth required)
+	r.Get("/auth/login", handlers.GetLoginURL)
+	r.Post("/auth/callback", handlers.OAuthCallback)
+	r.Post("/auth/refresh", handlers.RefreshToken)
+	r.Post("/auth/logout", handlers.Logout)
+
 	// Protected routes
 	r.Group(func(r chi.Router) {
 		r.Use(AuthMiddleware())