fix(auth): never sign anyone in through OIDC without an allowlist

[HouMinXi]

Summary

The OIDC callback treated an empty oidcAllowedSubjects as "let every
account of the identity provider in", and it minted the dashboard admin
session for whoever that was. The settings route was meant to prevent the
empty state, but it only ran when the request body itself set
oidcEnabled to true. With OIDC already on, a later update that sent
oidcAllowedSubjects: [] (a key that needs no password confirmation)
passed, and so did any state that did not come through that route.

Check the state the update would produce instead: reject it when OIDC
would be enabled and the allowlist would hold no non-blank entry, whether
the request changes the switch, the list or both. The callback now also
counts an allowlist without a usable entry as not configured, before it
contacts the provider, so an instance already in that state stops
admitting everybody. Password login is unaffected.

Related Issues

• None. This fixes a defect found by review, not a filed issue.

Validation

• Change type: other
• Focused tests: tests/unit/oidc-callback.test.ts, tests/unit/oidc-settings-allowlist-guard.test.ts
• npm run lint
• Reconciled with the current active release base
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/unit/oidc-callback.test.ts
• tests/unit/oidc-settings-allowlist-guard.test.ts

Coverage Notes

• The change is covered by the test files listed above. No coverage drop is expected; the new tests exercise the paths this PR adds.

Reviewer Notes

• An empty allowlist now refuses the sign-in instead of admitting every account. Operators who relied on the empty-means-open behaviour must set oidcAllowedSubjects before enabling OIDC.

[diegosouzapw]

Re-homed to release/v3.8.52: v3.8.51 entered its release freeze, so the branch now belongs to the release captain and development continues on the next cycle. Nothing is wrong with this PR — it just needed a live base. No action needed from you; CI will re-run against the new base.