#840 Integrate RODMENA Identity (OIDC) as sign-in option for highway-dashboard

EARS SPEC: - When a user chooses 'Sign in with RODMENA ID', the Highway API shall run an authorization_code+PKCE(S256) flow against https://identity.rodmena.co.uk (discovery-driven), with exact redirect URI https://highway.rodmena.app/api/v1/auth/oidc/callback. - When the ID token is received, the API shall verify it against the published JWKS (RS256, iss/aud/nonce/exp) with an independent JOSE lib, extract the verified email claim, and map it to Highway tenants via the existing RBAC path (get_user_accessible_tenants) exactly as the Google flow does. - While Identity integration is being validated, the existing Google OAuth flow shall remain available and unchanged (additive opt-in, not a replacement). - If offline_access refresh tokens are used, then the API shall persist the ROTATED refresh token on every refresh in exactly one place (identity revokes the whole family on reuse of a superseded token). - When silent re-auth is needed, the flow shall use a top-level redirect bounce, never a hidden iframe (cross-registrable-domain cookies are blocked in iframes). - When the integration is verified end-to-end against production identity (login, tenant mapping, logout, refresh rotation), Highway shall send a verify-result to identity thread thr-b8bd08bdce3e4121916d. Origin: identity offer 01KYVWTW218FFSK187BFA1T4SM; their discovery endpoint verified live by us (authorization_code+refresh_token, PKCE S256 only).