Add admin dashboard pages for OIDC client CRUD (list, create, edit, delete, rotate secret), a setup wizard with 10 app presets (Audiobookshelf, Jellyfin, Nextcloud, Gitea, Immich, Grafana, WikiJS, Portainer, Outline, Mealie), and a forward-auth proxy quick-setup wizard with nginx/k8s config snippets. Add integration tests for /auth/init redirect_uri handling per RCA-2026-02-22 to prevent regression of the bug where downstream app callbacks were passed as OAuth redirect_uri to the AT Protocol PDS. 262 tests passing, type check clean.