feat: OIDC/LDAP auth, audit log, maintenance windows, migrations

- Add OIDC (OpenID Connect) authentication with discovery URL support,
  group-based role mapping, and token introspection
- Add LDAP authentication with bind credentials, group-based role
  mapping, and configurable attribute names
- Add audit log (model, routes, templates) tracking settings changes,
  plugin enable/disable, login events
- Add migrations 0009 (widget variants), 0010 (maintenance windows),
  0011 (audit log)
- Add optional dependency groups to pyproject.toml: [ldap], [snmp]
- Add Settings → Auth tab with OIDC and LDAP configuration forms

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fabledscryer/templates/auth/login.html

@@ -4,6 +4,22 @@
 <div style="max-width:400px;margin:4rem auto;">
     <div class="card">
         <h2 class="page-title">Sign In</h2>
+        {% if error %}
+        <div style="color:var(--red);font-size:0.88rem;margin-bottom:1rem;
+                    background:var(--red-dim);padding:0.6rem 0.75rem;border-radius:4px;">
+          {{ error }}
+        </div>
+        {% endif %}
+        {% if oidc_enabled %}
+        <a href="/login/oidc" class="btn" style="width:100%;text-align:center;margin-bottom:1.25rem;display:block;">
+          Sign in with SSO
+        </a>
+        <div style="display:flex;align-items:center;gap:0.75rem;margin-bottom:1.25rem;">
+          <div style="flex:1;height:1px;background:var(--border-mid);"></div>
+          <span style="font-size:0.78rem;color:var(--text-dim);">or</span>
+          <div style="flex:1;height:1px;background:var(--border-mid);"></div>
+        </div>
+        {% endif %}
         <form method="post" action="/login">
             <div class="form-group">
                 <label>Username</label>
@@ -13,7 +29,9 @@
                 <label>Password</label>
                 <input type="password" name="password" required>
             </div>
-            <button type="submit" class="btn">Sign In</button>
+            <button type="submit" class="btn {% if oidc_enabled %}btn-ghost{% endif %}" style="width:100%;">
+              Sign In
+            </button>
         </form>
     </div>
 </div>