Authentification OIDC : tests, docker-compose et .env.example

- Tests avec un fournisseur OIDC simulé (RS256, ES256, HS256) : flux complet,
  groupes, state forgé, claims invalides, alg none, cookie altéré.
- Tests des modes AUTH_MODE dans cmd/server.
- docker-compose.yml et .env.example : AUTH_MODE, OIDC_*, SESSION_*.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018GBsBpHJW7GxFDBV7z1zmo

.env.example

@@ -1,6 +1,20 @@
 EXCALIDRAW_PORT=8080
+# local (Basic si AUTH_USER/AUTH_PASSWORD) ou oidc
+AUTH_MODE=local
 AUTH_USER=
 AUTH_PASSWORD=
+# AUTH_MODE=oidc. Émetteur, ex. Authentik : https://auth.example.org/application/o/excalicloud/
+# Keycloak : https://sso.example.org/realms/<realm>
+OIDC_ISSUER=
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+OIDC_REDIRECT_URL=
+OIDC_SCOPES=openid profile email
+OIDC_ALLOWED_GROUPS=
+OIDC_GROUPS_CLAIM=groups
+OIDC_LOGOUT=true
+SESSION_TTL=24h
+SESSION_SECRET=
 MAX_BODY_MB=50
 UPDATE_CHECK=true
 UPDATE_CHECK_INTERVAL=12h