feat(serve): wire Dex OIDC into serve when configured, else StubAuth

serve now uses oidc.DexAuth (single-user allowlist authz, ADR-011) when
TAPIR_OIDC_ISSUER is set, falling back to allow-all StubAuth for local dev.
Adds the Dex config fields (TAPIR_OIDC_ISSUER/DEX_CLIENT_ID/SECRET/
OIDC_REDIRECT_URL/SESSION_SECRET/ALLOWED_SUBJECT) + Config.DexConfigured().

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/config/config.go

@@ -56,8 +56,22 @@ type Config struct {
 
 	// HTTPAddr is the listen address for `tapir serve` (the Stage-0 web UI).
 	HTTPAddr string
+
+	// Dex OIDC (web login, ADR-011). When OIDCIssuer is empty, `serve` falls back
+	// to the allow-all StubAuth (local dev). When set, serve uses Dex with
+	// single-user allowlist authz.
+	OIDCIssuer      string
+	DexClientID     string
+	DexClientSecret string
+	OIDCRedirectURL string
+	SessionSecret   string
+	AllowedSubject  string
 }
 
+// DexConfigured reports whether Dex OIDC login is wired (issuer present). When
+// false, `serve` uses StubAuth (dev only).
+func (c Config) DexConfigured() bool { return strings.TrimSpace(c.OIDCIssuer) != "" }
+
 // Defaults (see docs/homelab-integration.md). All overridable via env.
 const (
 	defaultGatewayURL        = "http://koala:30401/v1"
@@ -85,6 +99,12 @@ func Load() (Config, error) {
 		SecretsFile:       envOr("TAPIR_SECRETS_FILE", defaultSecretsFile()),
 		OAuthRedirectAddr: envOr("TAPIR_OAUTH_REDIRECT_ADDR", defaultOAuthRedirectAddr),
 		HTTPAddr:          envOr("TAPIR_HTTP_ADDR", defaultHTTPAddr),
+		OIDCIssuer:        os.Getenv("TAPIR_OIDC_ISSUER"),
+		DexClientID:       os.Getenv("TAPIR_DEX_CLIENT_ID"),
+		DexClientSecret:   os.Getenv("TAPIR_DEX_CLIENT_SECRET"),
+		OIDCRedirectURL:   os.Getenv("TAPIR_OIDC_REDIRECT_URL"),
+		SessionSecret:     os.Getenv("TAPIR_SESSION_SECRET"),
+		AllowedSubject:    os.Getenv("TAPIR_ALLOWED_SUBJECT"),
 	}
 
 	timeout, err := durationOr("TAPIR_SUMMARIZER_TIMEOUT", defaultSummarizerTimeout)