Link OIDC users to Headscale users via providerId

[drifterza]

Related to #387

When oidc.integrate_headscale is enabled, Headplane matches the OIDC subject to Headscale users by extracting the subject from their providerId field (format: oidc/subject123). The matched Headscale user ID is stored in the database for future permission assignment.

Changes:

• Added headscale_user_id column to users table via migration
• Added integrate_headscale config option under oidc section
• OIDC callback queries Headscale API to find matching users
• Links are stored and updated on each login

API key authentication continues to work without onboarding (handled by existing shell loader check).

This PR handles the backend OIDC linking. See #481 for the complementary onboarding UI changes.

[tale]

I'm not really a fan of this implementation because it should be seamless and unless I'm mistaken, I had originally wrote it to match against the provider ID anyways, hence the stipulation that for Headscale and Headplane to work together they need to use the exact same OIDC provider otherwise they would fail.

[don-cline]

Closing - the auth rework (PR #489) already handles OIDC user matching in oidc-callback.ts. The linkHeadscaleUser call there does exactly what this PR was trying to do.

[drifterza]

Closing - the auth rework (PR #489) already handles OIDC user matching in oidc-callback.ts. The linkHeadscaleUser call there does exactly what this PR was trying to do.