feat: Oauth2 to Admin

[nagisa-kunhah]

Please provide a description of this PR:

This PR adds configurable GitHub OAuth and OpenID Connect (OIDC) login support to the Dubbo Admin Console while preserving the existing username/password login flow.

The backend now provides a unified authentication model based on Principal. Password, GitHub, and OIDC identities are stored in the existing Admin session using the same representation. Existing sessions containing the legacy user value remain supported and are converted to a local Principal when read.

The Console authentication configuration now supports:

• Explicit login methods, with password login enabled by default for backward compatibility.
• Multiple named GitHub or OIDC providers.
• Provider display names, client credentials, redirect URLs, post-login redirect URLs, and scopes.
• A configurable session secret and secure-cookie option.
• Validation for provider IDs, provider types, callback URLs, OIDC issuers, scopes, and production session secrets.

The following Console APIs are added:

• GET /api/v1/auth/providers
• GET /api/v1/auth/providers/:provider/login
• GET /api/v1/auth/providers/:provider/callback
• GET /api/v1/auth/userinfo

The OAuth/OIDC flow includes state validation, PKCE with S256, single-use login transactions, and OIDC nonce validation. GitHub identities are loaded from the GitHub user APIs, including verified-email fallback. OIDC providers are discovered from their issuer metadata, and their ID Tokens are validated before claims are mapped to a Principal.

The Vue login page now loads the enabled login methods from the Console, conditionally displays the password form, and renders buttons for configured providers. After authentication, the UI reads the current identity from /auth/userinfo so the header displays the authenticated provider username. Empty or null provider responses are handled safely for password-only deployments.

This change does not add AI-service authentication, Admin-issued access tokens, JWKS endpoints, RBAC, refresh tokens, or user-specific AI session isolation.

Backward compatibility is preserved:

• Password login remains the default when methods is omitted.
• Existing password-only deployments may continue using the legacy default session secret.
• OAuth/OIDC configuration is optional.
• Existing legacy Admin sessions remain readable.

Validation performed:

• go test ./...
• Focused Vue unit tests for the login page and authentication session utilities.
• ESLint and Prettier checks for the changed frontend files.
• git diff --cached --check

To help us figure out who should review this PR, please put an X in all the areas that this PR affects.

• Docs
• Installation
• User Experience
• Dubboctl
• Console
• Core Component

Please check any characteristics that apply to this pull request.

• Adds a backward-compatible feature
• Adds or changes Console configuration
• Changes authentication or security-sensitive behavior
• Adds backend tests
• Adds frontend tests
• Introduces a breaking change
• Requires a data migration
• Changes Dubboctl behavior
• Changes Core Component behavior

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud