Add provider-agnostic OIDC authentication with Keycloak-compatible configuration, frontend SSO UI support