feat: OAuth provider setup + auth secrets + web healthcheck

[Bccorb]

Makes seamless init --oauth produce a near-working OAuth example, and fixes two scaffold gaps. Pairs with fells-code/seamless-templates#5 (the setup.oauth manifest flag).

OAuth provider setup

• When the selected web template declares setup.oauth, init prompts for OIDC providers (Google, GitHub, Microsoft, GitLab) and each one's client id + secret.
• Wires them into the auth server: OAUTH_PROVIDERS config (endpoints, scopes, PKCE, redirect URI), a per-provider *_CLIENT_SECRET env var, and the oauth login method.
• Providers left blank are scaffolded disabled, and a next-steps note lists what to fill in plus the redirect URI to register (http://localhost:5173/oauth/callback).
• Apple is intentionally documented-as-manual: its client secret is a short-lived signed JWT (Team id, Key id, .p8 key) and it has no userinfo endpoint, so it does not fit a "paste a client id and secret" flow.

Scaffold fixes (apply to all templates)

• Generate REFRESH_TOKEN_LOOKUP_SECRET, TOTP_SECRET_ENCRYPTION_KEY, and OAUTH_STATE_SECRET, which were left empty (silently falling back to the service token).
• Add a healthcheck to the generated web container (nginx /health).

Validation

• Generation tested: secrets populated, OAUTH_PROVIDERS with an enabled provider (correct clientId/clientSecretEnv/redirectUri/pkce) and a disabled one for blank creds, per-provider secret env, oauth appended to LOGIN_METHODS, web healthcheck present. Non-OAuth scaffolds unchanged apart from the secrets/healthcheck.
• Prompt renders (Google/GitHub/Microsoft/GitLab); the setup.oauth gate reads correctly (react-oauth on, react-vite off).

Follow-up for production

Bump SEAMLESS_TEMPLATES_REF to the templates release that carries setup.oauth (after seamless-templates#5 merges and tags), so the OAuth prompts trigger for npx seamless-cli init --oauth. This PR's fixes work regardless of the templates ref.