feat(serve): wire Dex OIDC into serve when configured, else StubAuth

serve now uses oidc.DexAuth (single-user allowlist authz, ADR-011) when
TAPIR_OIDC_ISSUER is set, falling back to allow-all StubAuth for local dev.
Adds the Dex config fields (TAPIR_OIDC_ISSUER/DEX_CLIENT_ID/SECRET/
OIDC_REDIRECT_URL/SESSION_SECRET/ALLOWED_SUBJECT) + Config.DexConfigured().

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

cmd/tapir/main.go

@@ -32,6 +32,7 @@ import (
 	"gitea.d-ma.be/mathias/tapir/internal/runner"
 	"gitea.d-ma.be/mathias/tapir/internal/usecase"
 	"gitea.d-ma.be/mathias/tapir/internal/web"
+	"gitea.d-ma.be/mathias/tapir/internal/web/oidc"
 )
 
 func main() {
@@ -162,10 +163,28 @@ func cmdServe(ctx context.Context, log *slog.Logger) error {
 	}
 	defer st.Close()
 
-	// Auth seam: StubAuth allows every request as the configured user. The
-	// Conductor replaces this with oidc.DexAuth (lane B) at merge — nothing else
-	// in this function or the handlers changes (handlers depend on web.Auth only).
-	var authn web.Auth = web.StubAuth{U: web.User{Subject: cfg.UserID}}
+	// Auth seam (handlers depend on web.Auth only). With Dex configured
+	// (TAPIR_OIDC_ISSUER set) serve uses real OIDC login with single-user
+	// allowlist authz (ADR-011); otherwise it falls back to the allow-all
+	// StubAuth for local dev — never expose StubAuth publicly.
+	var authn web.Auth
+	if cfg.DexConfigured() {
+		authn, err = oidc.New(ctx, oidc.Config{
+			Issuer:         cfg.OIDCIssuer,
+			ClientID:       cfg.DexClientID,
+			ClientSecret:   cfg.DexClientSecret,
+			RedirectURL:    cfg.OIDCRedirectURL,
+			SessionSecret:  cfg.SessionSecret,
+			AllowedSubject: cfg.AllowedSubject,
+		})
+		if err != nil {
+			return fmt.Errorf("dex oidc: %w", err)
+		}
+		log.Info("web auth: dex oidc", "issuer", cfg.OIDCIssuer)
+	} else {
+		authn = web.StubAuth{U: web.User{Subject: cfg.UserID}}
+		log.Warn("web auth: STUB allow-all (no TAPIR_OIDC_ISSUER) — local dev only, do not expose")
+	}
 
 	app := &web.App{Store: st, Auth: authn, UserID: cfg.UserID, Log: log}
 	srv := &http.Server{