fix(oidc): don't strip issuer trailing slash (Authentik discovery match)

go-oidc requires the issuer passed to NewProvider to exactly match the issuer
in the discovery document. Authentik returns ".../application/o/<slug>/" with a
trailing slash; we were stripping it, causing "issuer did not match". Pass the
issuer verbatim and fall back to the alternate slash form.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/internal/auth/oidc.go

@@ -64,7 +64,23 @@ func (p *OIDCProvider) Configure(ctx context.Context, cfg config.OIDCConfig, red
 		return nil
 	}
 
-	provider, err := oidc.NewProvider(ctx, strings.TrimRight(cfg.Issuer, "/"))
+	// go-oidc strictly checks that the issuer we pass matches the issuer field
+	// in the discovery document. Providers differ on the trailing slash
+	// (Authentik returns ".../application/o/<slug>/" WITH a slash), so try the
+	// value verbatim first and then the alternate slash form.
+	issuer := strings.TrimSpace(cfg.Issuer)
+	provider, err := oidc.NewProvider(ctx, issuer)
+	if err != nil {
+		var alt string
+		if strings.HasSuffix(issuer, "/") {
+			alt = strings.TrimRight(issuer, "/")
+		} else {
+			alt = issuer + "/"
+		}
+		if provider2, err2 := oidc.NewProvider(ctx, alt); err2 == nil {
+			provider, err = provider2, nil
+		}
+	}
 	if err != nil {
 		return err
 	}