fix(oidc): retry issuer discovery with bounded back-off at start-up

A 503 from the issuer's discovery endpoint made `serve` exit and the pod
restart. New now retries discovery 5 times (2+4+8+16 s back-off, ~30 s)
before failing as before; a cancelled ctx ends the back-off at once.
WithDiscoveryRetry lets tests shrink the schedule.

Closes #59

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/oidc/oidc_test.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -34,6 +35,11 @@ type fakeIssuer struct {
 	sub   string
 	email string
 	nonce string
+
+	// discoveryHits counts requests to the discovery document; the first
+	// unavailableFor of them answer 503 (issuer briefly down behind its proxy).
+	discoveryHits  atomic.Int32
+	unavailableFor int32
 }
 
 const testKID = "test-key"
@@ -47,6 +53,10 @@ func newFakeIssuer(t *testing.T) *fakeIssuer {
 
 	mux := http.NewServeMux()
 	mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, _ *http.Request) {
+		if f.discoveryHits.Add(1) <= f.unavailableFor {
+			http.Error(w, "no available server", http.StatusServiceUnavailable)
+			return
+		}
 		writeJSON(t, w, map[string]any{
 			"issuer":                                f.server.URL,
 			"authorization_endpoint":                f.server.URL + "/authorize",