Fix OIDC authentication to support standards-compliant providers

[tilwegener]

Summary

This PR removes the remaining Keycloak-specific authentication logic from the frontend and delegates the complete OIDC flow to react-oidc-context / oidc-client-ts.

The previous implementation manually constructed the authorization request and manually exchanged the authorization code for tokens. This only worked with Keycloak because the endpoints were hardcoded as:

• /protocol/openid-connect/auth
• /protocol/openid-connect/token

As a result, standards-compliant OIDC providers such as Pocket ID could not authenticate successfully.

Changes

AuthGuard

• Replace manual authorization URL construction with auth.signinRedirect().
• Remove manual state and nonce generation.
• Remove unused imports (getAuthority, getClientId, getScope).

Callback Route

• Remove manual authorization code exchange.
• Remove custom token storage logic.
• Remove Keycloak-specific token endpoint usage.
• Let react-oidc-context / oidc-client-ts handle:
  • OIDC Discovery
  • PKCE
  • State validation
  • Nonce validation
  • Authorization code exchange
  • Token storage

The callback route is now only responsible for:

• displaying loading and error states
• redirecting the user back to the original page after successful authentication

Why

The project already depends on react-oidc-context, which internally uses oidc-client-ts to implement the complete Authorization Code Flow with PKCE.

By bypassing the library and implementing parts of the protocol manually, the frontend became tightly coupled to Keycloak-specific endpoints and omitted parts of the PKCE flow required by other OpenID Connect providers.

Using the library as intended restores compatibility with any standards-compliant OIDC provider exposing a valid discovery document.

Benefits

• Provider-agnostic OIDC implementation
• Compatible with Pocket ID
• Continues to work with Keycloak
• Standards-compliant PKCE implementation
• Less custom authentication code
• Easier maintenance
• Relies on the existing OIDC client as intended

Breaking Changes

None.

Existing OIDC configuration (authority, clientId, and scope) remains unchanged.

Testing

• Authentication with Keycloak
• Authentication with Pocket ID
• Authorization Code Flow with PKCE
• Login redirect
• Callback handling
• Return to originally requested page after authentication