fix(oidc): a successful SSO login writes the user.login audit row

Every other login method writes one; the SSO callback touched last_login and
login_count and wrote nothing, so an instance moving its users to SSO watched
its audit log go quiet while looking complete. The row is written in the
callback, where the provider has vouched for the user and the client IP is,
next to the role-change row, with method: oidc in the details the way the
passkey login names its method.

Closes #2417

server/src/nest/oidc/oidc.controller.ts

@@ -182,6 +182,11 @@ export class OidcController {
       }
 
       this.oidc.touchLastLogin(result.user.id);
+      // The login row every other method writes (#2417). Here rather than at
+      // /exchange, because this is where the provider has vouched for the user
+      // and where the client IP is, the same place the role change is recorded;
+      // `method` names the way in, as the passkey login does.
+      this.audit.writeAudit({ userId: result.user.id, action: 'user.login', ip: getClientIp(req), details: { method: 'oidc' } });
       // Pass the flag through untouched: `undefined` must reach the token as
       // "absent", not `false`, or the sliding renewal would later downgrade the
       // default persistent cookie to a browser-session one (remember-me, #1927).