feat: Oracle IAM OIDC, force password change, security hardening

- OIDC: authorization code flow, JWKS validation, JIT provisioning, group-to-role mapping, dual auth (local/oidc/both)
- Force password change: random admin password on first install, modal blocks UI until changed
- APP_SECRET required in docker-compose (fail if missing), .env.example improved
- Login page: Oracle IAM button (conditional), hide form in oidc-only mode
- OracleIamPage: test connection via backend, masked client_secret handling
- UsersPage: OIDC badge, auth_provider in list
- i18n: login.oidcButton, login.or (pt/en/es)
- README v3.1: Terminal, User Management, Security, OIDC endpoints, versioning

docker-compose.yml

@@ -6,7 +6,7 @@ services:
     container_name: oci-agent-backend
     restart: unless-stopped
     environment:
-      - APP_SECRET=${APP_SECRET:-change-me-in-production-use-a-long-random-string}
+      - APP_SECRET=${APP_SECRET:?Set APP_SECRET in .env (openssl rand -hex 64)}
       - JWT_EXPIRY_HOURS=${JWT_EXPIRY_HOURS:-12}
       - DATA_DIR=/data
       - CORS_ORIGINS=${CORS_ORIGINS:-}