feat(openvpn): suggest available OIDC ports and add deployment assets

frontend/src/locales/en-US.json

@@ -248,7 +248,8 @@
     "baseUrl": "Public sign-in URL",
     "baseTip": "Use a dedicated HTTPS root URL reachable before VPN connection. Give each OIDC tunnel its own endpoint.",
     "listenPort": "Local auth service port",
-    "portTip": "The service listens on 127.0.0.1 only; each tunnel needs a distinct port.",
+    "portTip": "Listens only on 127.0.0.1; no public access needed. New tunnels increment from 19090; +/- and manual entry skip configured and locally occupied ports.",
+    "portLookupFailed": "Could not find an available port. Retry or enter one manually.",
     "callbackTitle": "Register this callback with the final OIDC provider",
     "callbackTip": "With an identity broker, register this URL in the broker's OIDC client, and register the broker's upstream callback in Feishu. Reverse proxy the public endpoint to 127.0.0.1:{port}; :18080 does not handle this callback.",
     "testTip": "Install openvpn-auth-oauth2 and OpenVPN ≥ 2.6.2, then test with a WebAuth-capable client (e.g. OpenVPN Community for Windows or Tunnelblick/Viscosity for macOS). OpenVPN Connect v3 needs individual testing.",