GET /v1/auth/oidc/{org_slug} — initiate OIDC SSO for an organization.

Loads the org's OIDC config, performs discovery, generates an authorization URL with PKCE + nonce, stores state in DB, and returns the redirect URL.