fix(api): harden sign-in throttling, OIDC authorization and auth state

- Key login throttling on the real peer address; read X-Forwarded-For only
  from FLOCI_UI_TRUSTED_PROXIES (right-most untrusted hop). Add a per-IP
  limit across usernames so one attacker can no longer lock out the admin.
- Require an OIDC allow-list (FLOCI_UI_OIDC_ALLOWED_GROUPS / _EMAILS, or
  FLOCI_UI_OIDC_ALLOW_ALL_USERS=true); fall back to UserInfo for groups
  when the ID token omits them. Redirect IdP and token errors to /login
  instead of returning 500s; cache discovery and JWKS.
- Sweep expired sessions, attempts and pending OIDC requests every 60s,
  cap each map, and throttle OIDC sign-in starts per IP.
- Fix the .ts import extension that broke the API type-check.
- Add auth.test.ts and document the new settings.

.env.example

@@ -20,6 +20,10 @@ FLOCI_UI_SESSION_IDLE_TIMEOUT_SECONDS=1800
 FLOCI_UI_SESSION_ABSOLUTE_TIMEOUT_SECONDS=28800
 # Set false only for local HTTP development. Keep true behind HTTPS reverse proxies.
 FLOCI_UI_SECURE_COOKIES=true
+# Reverse proxies (IPs or CIDRs, comma-separated) allowed to report the client address
+# via X-Forwarded-For. Required behind Nginx Proxy Manager, otherwise every visitor
+# shares the proxy's address for sign-in throttling. Leave empty when exposed directly.
+# FLOCI_UI_TRUSTED_PROXIES=192.168.1.10
 
 # Optional Authentik / OIDC mode. These are server-only values.
 # FLOCI_UI_AUTH_MODE=oidc
@@ -27,3 +31,8 @@ FLOCI_UI_SECURE_COOKIES=true
 # FLOCI_UI_OIDC_CLIENT_ID=
 # FLOCI_UI_OIDC_CLIENT_SECRET=
 # FLOCI_UI_PUBLIC_BASE_URL=https://thecloud.example.com
+# OIDC mode refuses to start without an allow-list (comma-separated). Group names come
+# from the `groups` claim; emails must also be verified by the identity provider.
+# FLOCI_UI_OIDC_ALLOWED_GROUPS=thecloud-admins
+# FLOCI_UI_OIDC_ALLOWED_EMAILS=
+# FLOCI_UI_OIDC_ALLOW_ALL_USERS=false