feat(oidc): add auto-redirect for OIDC

add `auto_redirect_if_standalone_oidc` in `OXICLOUD_AUTH_POLICIES`
let admin decide to redirect immediately to IdP if OIDC is the only auth method enabled

frontend/src/routes/login/+page.svelte

@@ -249,19 +249,6 @@
 		}
 	}
 
-	// Shared by onMount step 4 and onSetup: true + navigates away iff OIDC is
-	// the only login method. Centralised so the guard can't drift between the
-	// two call sites (only the `?error=` loop-guard, checked at onMount time,
-	// doesn't apply post-setup — a freshly created admin can't have bounced
-	// off the IdP yet).
-	function tryAutoRedirectToIdp(): boolean {
-		if (oidc.enabled && oidc.password_login_enabled === false && oidc.authorize_endpoint) {
-			window.location.replace(oidc.authorize_endpoint);
-			return true;
-		}
-		return false;
-	}
-
 	async function onSetup(e: SubmitEvent) {
 		e.preventDefault();
 		setupError = '';
@@ -276,10 +263,6 @@
 			setupEmail = setupPassword = setupConfirm = '';
 			// Admin now exists — fold the setup affordance away and return to login.
 			setupAvailable = false;
-			// OIDC-only: the login page would immediately redirect on the next
-			// visit anyway — skip the "you can now sign in" detour and forward
-			// straight to the IdP instead of leaving a dead-end local form.
-			if (tryAutoRedirectToIdp()) return;
 			setupSuccess = t('auth.admin_success', 'Administrator created. You can now sign in.');
 			setTimeout(() => {
 				mode = 'login';
@@ -340,12 +323,11 @@
 		setupAvailable = !status.initialized;
 		if (setupAvailable) mode = 'setup';
 
-		// 4) Auto-redirect: when OIDC is the only auth method, skip the login page.
-		//    Guard against loops: if the IdP returned ?error=, fall through to the UI.
-		if (!setupAvailable && !page.url.searchParams.has('error') && tryAutoRedirectToIdp()) {
-			return;
-		}
-
+		// Auto-redirect to the IdP in standalone-OIDC posture is enforced
+		// server-side via the `auto_redirect_if_standalone_oidc` auth policy
+		// (see interfaces/web/mod.rs::oidc_standalone_login_redirect). Keeping
+		// a client-side copy would make the policy toggle a no-op — the SPA
+		// would auto-redirect regardless of what the admin configured.
 		booting = false;
 	});