feat: Oracle IAM OIDC, force password change, security hardening

- OIDC: authorization code flow, JWKS validation, JIT provisioning, group-to-role mapping, dual auth (local/oidc/both)
- Force password change: random admin password on first install, modal blocks UI until changed
- APP_SECRET required in docker-compose (fail if missing), .env.example improved
- Login page: Oracle IAM button (conditional), hide form in oidc-only mode
- OracleIamPage: test connection via backend, masked client_secret handling
- UsersPage: OIDC badge, auth_provider in list
- i18n: login.oidcButton, login.or (pt/en/es)
- README v3.1: Terminal, User Management, Security, OIDC endpoints, versioning

frontend-react/src/i18n/pt.ts

@@ -45,6 +45,8 @@ const pt: Record<string, string> = {
   'login.verify': 'Verificar',
   'login.submit': 'Entrar',
   'login.error': 'Erro ao fazer login',
+  'login.or': 'ou',
+  'login.oidcButton': 'Login com Oracle IAM',
 
   // ── Chat ──
   'chat.timeNow': 'agora',