feat: rework oidc to be more resilient

This includes setting a custom redirect URI, handling errors, and using a better library.
As an API decision I've also disabled per session API keys as it clutters up too much.

app/routes.ts

@@ -9,6 +9,7 @@ export default [
 	route('/login', 'routes/auth/login.tsx'),
 	route('/logout', 'routes/auth/logout.ts'),
 	route('/oidc/callback', 'routes/auth/oidc-callback.ts'),
+	route('/oidc/start', 'routes/auth/oidc-start.ts'),
 
 	// All the main logged-in dashboard routes
 	layout('layouts/dashboard.tsx', [