feat(auth): let admins keep the login page on OIDC-only instances (#2925)

A new app setting oidc_auto_redirect (default on) is part of the admin form
and the public app config. Off, an instance without password login no longer
sends visitors straight to the IdP: the login page shows its SSO button,
also while the cached config is read. Admin toggle on desktop and phone.

server/src/nest/auth/auth.service.ts

@@ -359,6 +359,9 @@ export class AuthService {
       password_registration: isDemo ? false : toggles.password_registration,
       oidc_login: toggles.oidc_login,
       oidc_registration: isDemo ? false : toggles.oidc_registration,
+      // Read by the login page only where password login is off: anything but
+      // 'false' keeps the redirect every such instance had before (#2925).
+      oidc_auto_redirect: settings.get('oidc_auto_redirect') !== 'false',
       // Passkey login: the instance toggle + whether a usable RP ID resolves for
       // this deployment. The login page shows the passkey button only when both
       // are true. `passkey_configured` stays a pure boolean — it never leaks the

server/src/nest/common/app-settings.registry.ts

@@ -84,6 +84,9 @@ export const APP_SETTINGS = {
   password_registration: { schema: flag, default: 'true', adminForm: true },
   oidc_login: { schema: flag, default: 'true', adminForm: true, managedLocked: true },
   oidc_registration: { schema: flag, default: 'true', adminForm: true, managedLocked: true },
+  // Whether an instance without password login sends a visitor straight to the
+  // identity provider. Off shows the login page with its SSO button first (#2925).
+  oidc_auto_redirect: { schema: flag, default: 'true', adminForm: true, publicConfig: true },
   passkey_login: { schema: flag, default: 'false', adminForm: true },
   webauthn_rp_id: { schema: text, default: null, adminForm: true, managedLocked: true },
   webauthn_origins: { schema: text, default: null, adminForm: true, managedLocked: true },