feat: add Eve-compatible Jinshuju OIDC auth

[mechiland]

What changed

• publishable @jinshuju/eve-oidc package for Eve 0.24.6 route auth
• opaque Bearer token verification through OIDC UserInfo
• fail-closed runtime config resolved when jinshujuOidc() is called
• sanitized provider-failure responses with no token or upstream-body leakage
• bounded HTTPS discovery/UserInfo requests and conservative profile projection
• CI, package build metadata, usage docs, and 11 contract tests

Eve mapping

A verified UserInfo sub becomes an Eve user SessionAuthContext with:

• authenticator: jinshuju-oidc
• principalId: <issuer>:<sub>
• exact issuer and subject
• only selected string/string-array profile attributes

Validation

• pnpm test — 11/11
• pnpm typecheck
• pnpm build
• npm pack --dry-run — 7 expected package files
• cross-repository UAT using Eveland createOpenIdClientProtocol to exchange Authorization Code + PKCE for an opaque token, then this package to verify UserInfo and create an Eve caller

The npm name @jinshuju/eve-oidc is currently unclaimed. Publishing is intentionally deferred until this PR is merged and npm credentials or trusted publishing are configured.