Clarify Feishu app setup and OpenVPN OIDC source

backend/internal/service/openvpn/oidc.go

@@ -101,10 +101,23 @@ func prepareOIDC(t *model.Tunnel, cfg map[string]interface{}) error {
 	if err != nil {
 		return err
 	}
-	if service.Str(cfg, "oidc_client_secret") == "" {
+	oldCfg, err := store.TunnelConfig(t)
+	if err != nil {
+		return err
+	}
+	builtin := service.Str(cfg, "oidc_provider") == "builtin"
+	if !builtin && service.Str(oldCfg, "oidc_provider") != "builtin" && service.Str(cfg, "oidc_client_secret") == "" {
 		cfg["oidc_client_secret"] = old["oidc_client_secret"]
 	}
-	if secret, ok := identityprovider.ClientForIssuer(service.Str(cfg, "oidc_issuer"), service.Str(cfg, "oidc_client_id")); ok {
+	if builtin {
+		issuer, clientID, ready := identityprovider.PublicClient()
+		if !ready || issuer != service.Str(cfg, "oidc_issuer") || clientID != service.Str(cfg, "oidc_client_id") || strings.TrimSuffix(issuer, "/id") != strings.TrimRight(service.Str(cfg, "oidc_base_url"), "/") {
+			return fmt.Errorf("内置飞书身份服务未启用或与当前专线配置不匹配；请在系统设置中启用后重新选择")
+		}
+		secret, ok := identityprovider.ClientForIssuer(issuer, clientID)
+		if !ok {
+			return fmt.Errorf("无法获取内置 VPN 客户端凭据")
+		}
 		cfg["oidc_client_secret"] = secret
 	}
 	if service.Str(cfg, "oidc_client_secret") == "" {