docs: add dedicated AUTH.md and deduplicate auth info across docs

Create AUTH.md as the canonical reference for authentication: password
auth, OAuth/SSO setup, provider-specific guides (Authentik, Keycloak,
Okta/Auth0), env vars, callback URLs, security notes, and
troubleshooting. Fixes incorrect env var names and callback URL patterns
that had drifted in DEPLOYMENT.md. Other docs now cross-link to AUTH.md
instead of duplicating content.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/FEATURES.md

@@ -86,20 +86,12 @@
 - Clear search to restore original view
 - Case-insensitive matching
 
-### Authentication
-- Multi-user support with role-based access (admin / user)
-- First-run setup: create admin account (min 8 chars password)
-- Argon2 password hashing (industry standard)
-- Session-based auth with 30-day expiry
-- Active session management (view, revoke individual or all other sessions)
-- All routes protected except /login and /setup
-- Account deletion with password confirmation
-
-### OAuth / SSO
-- Optional social login via Google, GitHub, or generic OIDC
-- OAuth users created automatically on first sign-in
-- Invite-only mode when combined with admin controls
-- Configure via environment variables (`AUTH_GOOGLE_ID`, `AUTH_GITHUB_ID`, `AUTH_OIDC_ISSUER`, etc.)
+### Authentication & OAuth / SSO
+- Multi-user with role-based access (admin / user)
+- Password auth (Argon2) + optional OAuth/SSO (Google, GitHub, any OIDC provider)
+- Session-based auth with active session management
+- Invite-only OAuth model with PKCE-secured flows
+- See [AUTH.md](AUTH.md) for full details and provider setup guides
 
 ### User Management (admin)
 - Admin dashboard to create, list, and delete users